When the EU Cyber Resilience Act (CRA) was introduced into law in 2024, it represented one of the most significant regulatory shifts we've seen anywhere in the world with implications for how organizations build, ship, and maintain software. It establishes cybersecurity requirements for hardware and software products sold within the European Union or produced by organizations operating in the EU, and is among the first international legislation focused on cybersecurity requirements. It was also part of a wave of global regulations that put the security of software supply chains in the spotlight.

Some CRA requirements will go into effect in September of this year, with full enforcement beginning in December 2027. While that may sound like plenty of time to prepare, it'll be here before we know it. Product security, engineering, and compliance teams will never have more time to prepare than they do right now, so the work of turning regulatory requirements into practical action should already be underway.

This is why we brought together two industry experts to discuss this topic during our recent webinar, "Preparing for CRA Enforcements: Steps for Software Teams." Eddie Knight, OSPO Technical Program Manager at Sonatype, joined Christopher Robinson, Chief Technical Officer at OpenSSF and Chief Security Architect at the Linux Foundation, to answer questions about how teams can prepare. Their discussion focused on practical steps organizations can take today, covering risk assessment, incident response, data protection, governance, and software supply chain transparency.

Effective ICT Risk Assessment and CRA Enforcement

Effective ICT risk management begins with understanding what needs to be protected. Organizations must first gain visibility into their software environments by identifying the components within their applications, including all dependencies. Software bills of materials (SBOMs) are essential for this process, as they help define the boundaries of an application and enable teams to analyze and manage risk more effectively.

Continuous monitoring also plays an important role in reducing compliance risks. This is the only way manufacturers will be able to comply with the timelines, in particular the CRA requirements around vulnerability reporting.

The most successful organizations building these programs integrate automation directly into their development workflows. Automated scanning, dependency tracking, and vulnerability intelligence are embedded into CI pipelines, enabling teams, whether upstream projects or downstream manufacturers, to continuously identify and manage risk throughout the development process.

Incident Response in a Post-CRA World

Incident response is emerging as one of the biggest operational challenges for organizations preparing for CRA enforcement. Organizations should establish clear communication channels both internally and externally. Internally, teams must be able to quickly coordinate when security events occur. Externally, they must maintain communication channels with regulatory bodies responsible for oversight. These processes become particularly important when responding to qualifying events, which require rapid reporting timelines.

One way to ensure your incident response plans are ready for real-world situations is through tabletop exercises. These simulated scenarios bring together stakeholders from across the organization, including engineering, legal, communications, and marketing, to walk through a theoretical scenario.

SBOMs also play a role in incident response and compliance reporting. When maintained properly, SBOMs provide organizations with an inventory of their software components and dependencies. With the right tooling and visibility, teams can identify vulnerabilities and understand where they exist across the software landscape, making reporting and remediation more efficient.

Addressing Data Protection Challenges

Data protection is another critical area of CRA compliance. Weak key management practices, inconsistent encryption practices, and limited visibility into how sensitive data moves through software systems are some of the most common gaps.

Encryption and regular security audits can help address these gaps. Encryption ensures that data protection mechanisms are consistently applied, while audits help verify that security policies are properly implemented and enforced. Through regular auditing, organizations can ensure that policies are connected to the correct regulatory requirements and that teams are building software according to those policies.

Embedding security checks directly into development pipelines is essential. When encryption policies, security checks, and compliance validation are integrated into CI pipelines, security becomes part of the development workflow rather than a barrier to delivery.

Governance, Policies, and Organizational Leadership

Effective planning for CRA enforcement can't underestimate the value of open communication. Without clear connections between external regulatory guidance, internal risk catalogs, software development lifecycle processes, and auditing practices, organizations struggle to scale governance effectively. Establishing these connections allows teams to enforce policies consistently across large environments.

Training and awareness also play a role. Continuous, role-specific cybersecurity training rather than relying solely on annual compliance exercises can make a big difference in preparedness. In addition, translating policies into automated enforcement mechanisms can help organizations validate compliance automatically as artifacts move through CI pipelines.

While CRA enforcement timelines extend several years into the future, the discussion made one point clear: preparation needs to begin now. Visibility into software components, automated monitoring, structured incident response processes, strong governance, and supply chain transparency are all foundational capabilities organizations must build.

Preparing for CRA Enforcement

As regulatory expectations continue to evolve, teams that integrate security and compliance into their development processes today will be better positioned to meet CRA requirements. This means having the right tools and the right priorities in place to deliver applications that are both secure and compliant.