{"id":8246355,"date":"2026-11-04T11:19:38","date_gmt":"2026-11-04T11:19:38","guid":{"rendered":"https:\/\/scn.eu\/?post_type=scn_guide&#038;p=8246355"},"modified":"2026-11-04T11:19:52","modified_gmt":"2026-11-04T11:19:52","slug":"cyber-resilience-act","status":"publish","type":"scn_guide","link":"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/","title":{"rendered":"Cyber Resilience Act (CRA) \u2013 what the EU\u2019s new cyber rules mean for industrial networks"},"content":{"rendered":"<div class=\"scn-guide\">\n<h1>Cyber Resilience Act (CRA) \u2013 what the EU\u2019s new cyber rules mean for industrial networks<\/h1>\n<p class=\"g-lead\">The switch in the control cabinet, the router for remote service and the industrial computer on the line are now \u2018products with digital elements\u2019 under EU law. The Cyber Resilience Act (CRA) sets requirements for how they are developed, updated and documented. Here we explain what applies, when it applies and what to ask for when you buy.<\/p>\n<div class=\"g-short\"><b class=\"t\">Short answer<\/b><\/p>\n<ul>\n<li><b>What:<\/b> EU Regulation (EU) 2024\/2847, which sets cybersecurity requirements for all hardware and software that can be connected to a network or to another device.<\/li>\n<li><b>Who is responsible:<\/b> primarily the manufacturer. Importers and distributors must check the CE marking and documentation.<\/li>\n<li><b>When:<\/b> reporting of actively exploited vulnerabilities has applied since 11 September 2026. The remaining requirements apply to products placed on the market from 11 December 2027.<\/li>\n<li><b>What you will notice:<\/b> CE marking will cover cybersecurity, and every product will have a stated support period with security updates, normally at least five years.<\/li>\n<li><b>Switches and routers<\/b> count as \u2018important products\u2019 (class I), <b>firewalls<\/b> as class II, with a requirement for third-party assessment.<\/li>\n<\/ul>\n<\/div>\n<h2>What is the Cyber Resilience Act?<\/h2>\n<p>The CRA is the first EU law to set cybersecurity requirements directly for products, in the same way that the Low Voltage and EMC Directives set requirements for electrical safety and interference. The Regulation entered into force on 10 December 2024 and applies throughout the EU without member states having to pass their own laws.<\/p>\n<p>It covers everything with \u2018digital elements\u2019 that can be connected to a network or another device: switches, routers, gateways, industrial computers, operator panels, connected sensors and the software supplied with them. There are exemptions for areas that already have their own rules, such as medical devices, motor vehicles, civil aviation and marine equipment.<\/p>\n<h2>The timeline<\/h2>\n<figure><img loading=\"lazy\" src=\"https:\/\/scn.eu\/wp-content\/uploads\/2026\/11\/scn-guide-cra-f1-en.webp\" alt=\"Timeline for the Cyber Resilience Act: entry into force on 10 December 2024, rules for notified bodies from 11 June 2026, reporting of actively exploited vulnerabilities from 11 September 2026 and all requirements from 11 December 2027.\" width=\"1520\" height=\"500\" loading=\"lazy\" decoding=\"async\"><figcaption>The reporting obligation already applies. The remaining requirements apply to products placed on the market from 11 December 2027.<\/figcaption><\/figure>\n<p>Products placed on the market before 11 December 2027 may continue to be sold and used. The manufacturer\u2019s reporting obligation, however, already applies now, including to those products.<\/p>\n<h2>What does the CRA require of the manufacturer?<\/h2>\n<ul>\n<li><b>Secure by design:<\/b> a risk assessment, no known vulnerabilities on delivery, secure default settings with no default passwords, and protection of data and access.<\/li>\n<li><b>Vulnerability handling throughout the support period:<\/b> security updates without delay, a contact point for reporting vulnerabilities and a list of the software components (SBOM).<\/li>\n<li><b>Support period:<\/b> the manufacturer must state how long the product will receive security updates. It must reflect the expected time of use and is normally at least five years.<\/li>\n<li><b>Reporting:<\/b> actively exploited vulnerabilities and severe incidents are reported to ENISA \u2013 an early warning within 24 hours, a notification within 72 hours and a final report after that.<\/li>\n<li><b>Documentation:<\/b> technical documentation, an EU declaration of conformity and CE marking.<\/li>\n<\/ul>\n<p>Fines can reach \u20ac15 million or 2.5 per cent of global turnover.<\/p>\n<h2>Class I, class II and critical products<\/h2>\n<p>Most products fall into the default category, where the manufacturer itself assesses whether the requirements are met. Products of greater importance for security are listed as \u2018important products\u2019.<\/p>\n<div class=\"g-tbl\">\n<table>\n<thead>\n<tr>\n<th>Category<\/th>\n<th>Examples in industrial networks<\/th>\n<th>Assessment<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td class=\"n\">Default<\/td>\n<td>Protocol gateways, I\/O modules, sensors, most industrial computers<\/td>\n<td>The manufacturer itself<\/td>\n<\/tr>\n<tr>\n<td class=\"n\">Important, class I<\/td>\n<td>Switches, routers, products with VPN, network management systems, operating systems<\/td>\n<td>The manufacturer itself if harmonised standards are applied in full, otherwise a third party<\/td>\n<\/tr>\n<tr>\n<td class=\"n\">Important, class II<\/td>\n<td>Firewalls, intrusion detection systems<\/td>\n<td>Always a third party<\/td>\n<\/tr>\n<tr>\n<td class=\"n\">Critical<\/td>\n<td>Including smartcards and smart meter gateways<\/td>\n<td>Special certification<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>Where a particular product ends up depends on its core functionality. A secure router with a firewall may therefore be assessed differently from a simple switch. Ask the manufacturer how they have classified the product.<\/p>\n<h2>What does IEC 62443 have to do with it?<\/h2>\n<p>IEC 62443 is the established series of standards for cybersecurity in industrial automation systems. Two parts are of particular interest to anyone buying components:<\/p>\n<ul>\n<li><b>IEC 62443-4-1<\/b> describes a secure development process at the manufacturer: how products are designed, tested and maintained.<\/li>\n<li><b>IEC 62443-4-2<\/b> sets technical security requirements for the component itself, in four security levels (SL 1\u20134).<\/li>\n<\/ul>\n<p>IEC 62443 is not the same as the CRA, and the EU is developing its own harmonised standards for the Regulation. But the requirements overlap to a large extent. A manufacturer that is already certified to IEC 62443-4-1 and has products certified to 62443-4-2 is well on the way.<\/p>\n<h2>What should you ask your supplier?<\/h2>\n<div class=\"g-short\"><b class=\"t\">Six questions to ask<\/b><\/p>\n<ul>\n<li><b>Classification:<\/b> how have you classified the product under the CRA, and when will it be CE marked under the Regulation?<\/li>\n<li><b>Support period:<\/b> how long will the product receive security updates, and how are they delivered?<\/li>\n<li><b>Vulnerabilities:<\/b> how do we report a vulnerability to you, and how do you announce new ones (security advisories, PSIRT)?<\/li>\n<li><b>SBOM:<\/b> is there a list of the software components in the product?<\/li>\n<li><b>IEC 62443:<\/b> is the development process or the product certified to 62443-4-1 and 4-2?<\/li>\n<li><b>Earlier deliveries:<\/b> will products we buy before December 2027 continue to receive updates?<\/li>\n<\/ul>\n<\/div>\n<h2>If you build machines or installations<\/h2>\n<p>If you build a switch or industrial computer into a machine you sell in the EU, the machine does not automatically become a CRA product \u2013 it is the components that must comply with the Regulation. But you are responsible for the safety of the machine as a whole. The new Machinery Regulation (EU) 2023\/1230, which applies from 20 January 2027, requires among other things protection against corruption that could lead to hazardous situations. So choose components with a long support period and documented vulnerability handling, and plan how updates will be carried out at the end customer\u2019s site.<\/p>\n<p>If you sell software or a product with digital elements under your own name, you count as the manufacturer yourself.<\/p>\n<h2>Common mistakes<\/h2>\n<ol class=\"g-pit\">\n<li><b>Waiting until 2027.<\/b> The reporting obligation already applies, and projects delivered after December 2027 should be planned with CRA-compliant components now.<\/li>\n<li><b>Confusing CE marking with cybersecurity.<\/b> Today\u2019s CE marking does not cover cybersecurity. It only will with the CRA.<\/li>\n<li><b>Forgetting the support period.<\/b> A switch that will sit in an installation for 15 years needs updates for longer than an office switch. Compare support periods, not just prices.<\/li>\n<li><b>Leaving default settings.<\/b> Even a CRA-compliant product must be configured correctly: change passwords, close unused ports and services and divide the network into zones.<\/li>\n<\/ol>\n<h2>Network products from SCN<\/h2>\n<p>Our manufacturers of switches, routers and industrial computers are preparing for the CRA. Moxa, for example, is certified to IEC 62443-4-1 and has products certified to IEC 62443-4-2. As a distributor, we check that products have the correct CE marking and documentation, and we pass on security information from the manufacturers to you. Ask us about the support period and CRA status of a particular product.<\/p>\n<h3>Examples from our range<\/h3>\n<div class=\"g-prod\"><a class=\"g-pc\" href=\"https:\/\/scn.eu\/en\/product\/eds-4008\/\"><img loading=\"lazy\" src=\"https:\/\/scn.eu\/wp-content\/uploads\/2025\/01\/moxa-eds-4008-series-image-2.jpeg\" alt=\"Moxa EDS-4008 managed switch\" width=\"800\" height=\"800\" loading=\"lazy\" decoding=\"async\"><span class=\"g-pb\">Moxa<\/span><span class=\"g-pn\">EDS-4008 managed switch<\/span><span class=\"g-pw\">Managed switch in the EDS-4000 Series, certified to IEC 62443-4-2.<\/span><\/a><a class=\"g-pc\" href=\"https:\/\/scn.eu\/en\/product\/edr-g9010\/\"><img loading=\"lazy\" src=\"https:\/\/scn.eu\/wp-content\/uploads\/2026\/10\/moxa-edr-g9010-main.webp\" alt=\"Moxa EDR-G9010 secure 10-port gigabit router\" width=\"800\" height=\"800\" loading=\"lazy\" decoding=\"async\"><span class=\"g-pb\">Moxa<\/span><span class=\"g-pn\">EDR-G9010 secure gigabit router<\/span><span class=\"g-pw\">Router, firewall and switch in one, certified to IEC 62443-4-2 level SL2.<\/span><\/a><a class=\"g-pc\" href=\"https:\/\/scn.eu\/en\/product\/tn-4900\/\"><img loading=\"lazy\" src=\"https:\/\/scn.eu\/wp-content\/uploads\/2026\/10\/moxa-tn-4900-main.webp\" alt=\"Moxa TN-4900 secure M12 router for rolling stock\" width=\"800\" height=\"800\" loading=\"lazy\" decoding=\"async\"><span class=\"g-pb\">Moxa<\/span><span class=\"g-pn\">TN-4900 secure M12 router<\/span><span class=\"g-pw\">Secure router with M12 connectors for trains and vehicles, certified to IEC 62443-4-2 level SL2.<\/span><\/a><\/div>\n<div class=\"g-links\"><a href=\"https:\/\/scn.eu\/en\/product-category\/products\/network-products\/ethernet\/managed-switches\/\">Managed switches<\/a><a href=\"https:\/\/scn.eu\/en\/product-category\/products\/network-products\/\">Network products<\/a><a href=\"https:\/\/scn.eu\/en\/product-category\/products\/industrial-computers\/\">Industrial computers<\/a><\/div>\n<div class=\"g-cta\">\n<p>Want to know the CRA status and support period of a particular product? Ask our engineers \u2013 you will get an answer within 24 hours.<\/p>\n<p><a href=\"https:\/\/scn.eu\/en\/contact\/\">Ask an engineer<\/a><\/div>\n<h2>Frequently asked questions<\/h2>\n<details>\n<summary>Does the CRA apply to products we have already installed?<\/summary>\n<p>No, the requirements apply to products placed on the market from 11 December 2027. Installed equipment does not need to be replaced. However, manufacturers must already report actively exploited vulnerabilities, including in older products.<\/p>\n<\/details>\n<details>\n<summary>Can we buy switches without CRA marking after December 2027?<\/summary>\n<p>Products placed on the market before that date may continue to be sold, for example from stock. Products placed on the market after that date must comply with the CRA.<\/p>\n<\/details>\n<details>\n<summary>Which CRA class does an industrial switch fall into?<\/summary>\n<p>Class I. Routers, modems and switches count as important products, which means stricter requirements for how the manufacturer demonstrates that the product meets the requirements. A router with firewall functionality may fall into class II.<\/p>\n<\/details>\n<details>\n<summary>Is it enough for the product to be certified to IEC 62443?<\/summary>\n<p>Not automatically. IEC 62443 covers many of the same requirements and is a strong sign that the manufacturer takes security seriously, but formally it is CE marking under the CRA that counts.<\/p>\n<\/details>\n<details>\n<summary>Does the CRA apply in the UK and Norway?<\/summary>\n<p>The CRA is an EU regulation and applies directly in EU member states. It is marked as EEA-relevant and is expected to become part of the EEA Agreement, but as of November 2026 it had not yet been incorporated into Norwegian law. The UK has its own rules. Anyone selling into the EU must comply with the CRA regardless.<\/p>\n<\/details>\n<p><small>This is general guidance, not legal advice. The full text of the Regulation is available on <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/2847\/oj\" rel=\"noopener\" target=\"_blank\">EUR-Lex: Regulation (EU) 2024\/2847<\/a>.<\/small><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The switch in the control cabinet, the router for remote service and the industrial computer on the line are now \u2018products with digital elements\u2019 under EU law. The Cyber Resilience Act (CRA) sets requirements for how they are developed, updated and documented. Here we explain what applies, when it applies and what to ask for when you buy.<\/p>\n","protected":false},"author":11,"featured_media":8246354,"template":"","meta":{"_yoast_wpseo_focuskw":"cyber resilience act","_yoast_wpseo_metadesc":"What the EU Cyber Resilience Act requires of switches, routers and industrial computers, which dates apply and what to ask your supplier. A guide from SCN.","_kad_post_transparent":"","_kad_post_title":"hide","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"hide","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","_scn_guide_cats":[862,863,871,869,868,789],"_scn_guide_sectors":[1011,1080],"_scn_guide_type":"tech","_scn_guide_order":21,"footnotes":""},"class_list":["post-8246355","scn_guide","type-scn_guide","status-publish","has-post-thumbnail","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Cyber Resilience Act (CRA) \u2013 what the EU\u2019s new cyber rules mean for industrial networks | SCN<\/title>\n<meta name=\"description\" content=\"What the EU Cyber Resilience Act requires of switches, routers and industrial computers, which dates apply and what to ask your supplier. A guide from SCN.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cyber Resilience Act (CRA) \u2013 what the EU\u2019s new cyber rules mean for industrial networks | SCN\" \/>\n<meta property=\"og:description\" content=\"What the EU Cyber Resilience Act requires of switches, routers and industrial computers, which dates apply and what to ask your supplier. A guide from SCN.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/\" \/>\n<meta property=\"og:site_name\" content=\"SCN\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-04T11:19:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/scn.eu\/wp-content\/uploads\/2026\/11\/scn-guide-cra-f1-en.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1520\" \/>\n\t<meta property=\"og:image:height\" content=\"500\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/guides\\\/cyber-resilience-act\\\/\",\"url\":\"https:\\\/\\\/scn.eu\\\/en\\\/guides\\\/cyber-resilience-act\\\/\",\"name\":\"Cyber Resilience Act (CRA) \u2013 what the EU\u2019s new cyber rules mean for industrial networks | SCN\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/guides\\\/cyber-resilience-act\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/guides\\\/cyber-resilience-act\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/scn.eu\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/scn-guide-cra-f1-en.webp\",\"datePublished\":\"2026-11-04T11:19:38+00:00\",\"dateModified\":\"2026-11-04T11:19:52+00:00\",\"description\":\"What the EU Cyber Resilience Act requires of switches, routers and industrial computers, which dates apply and what to ask your supplier. A guide from SCN.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/guides\\\/cyber-resilience-act\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/scn.eu\\\/en\\\/guides\\\/cyber-resilience-act\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/guides\\\/cyber-resilience-act\\\/#primaryimage\",\"url\":\"https:\\\/\\\/scn.eu\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/scn-guide-cra-f1-en.webp\",\"contentUrl\":\"https:\\\/\\\/scn.eu\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/scn-guide-cra-f1-en.webp\",\"width\":1520,\"height\":500,\"caption\":\"Timeline for the Cyber Resilience Act: entry into force on 10 December 2024, rules for notified bodies from 11 June 2026, reporting of actively exploited vulnerabilities from 11 September 2026 and all requirements from 11 December 2027.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/guides\\\/cyber-resilience-act\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/scn.eu\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber Resilience Act (CRA) \u2013 what the EU\u2019s new cyber rules mean for industrial networks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/scn.eu\\\/en\\\/\",\"name\":\"SCN\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/scn.eu\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/#organization\",\"name\":\"Sensor Control Nordic\",\"alternateName\":\"SCN\",\"url\":\"https:\\\/\\\/scn.eu\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/scn.eu\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/SCN-logo-scaled.png\",\"contentUrl\":\"https:\\\/\\\/scn.eu\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/SCN-logo-scaled.png\",\"width\":2560,\"height\":632,\"caption\":\"Sensor Control Nordic\"},\"image\":{\"@id\":\"https:\\\/\\\/scn.eu\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/sensor-control-nordic-ab\"],\"location\":[{\"@type\":\"Place\",\"name\":\"SCN Walsall\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"46 Hall Lane, Walsall Wood\",\"addressLocality\":\"Walsall\",\"postalCode\":\"WS9 9DP\",\"addressCountry\":\"GB\",\"addressRegion\":\"West Midlands\"},\"telephone\":\"+44 1634 300 900\"},{\"@type\":\"Place\",\"name\":\"SCN Stockholm\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Gustav III:s Boulevard 32\",\"addressLocality\":\"Solna\",\"postalCode\":\"169 73\",\"addressCountry\":\"SE\"},\"telephone\":\"+46 8 668 21 00\"},{\"@type\":\"Place\",\"name\":\"SCN Malm\u00f6\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"R\u00f6nnviksgatan 13\",\"addressLocality\":\"Malm\u00f6\",\"postalCode\":\"213 74\",\"addressCountry\":\"SE\"},\"telephone\":\"+46 40 688 02 00\"},{\"@type\":\"Place\",\"name\":\"SCN Sundsvall\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Trafikgatan 11\",\"addressLocality\":\"Sundsvall\",\"postalCode\":\"856 44\",\"addressCountry\":\"SE\"},\"telephone\":\"+46 60 740 75 81\"},{\"@type\":\"Place\",\"name\":\"SCN Helsinki\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Huopalahdentie 24A\",\"addressLocality\":\"Helsinki\",\"postalCode\":\"00350\",\"addressCountry\":\"FI\"},\"telephone\":\"+358 20 734 8600\"},{\"@type\":\"Place\",\"name\":\"SCN Tallinn\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Narva mnt 5\",\"addressLocality\":\"Tallinn\",\"postalCode\":\"10117\",\"addressCountry\":\"EE\"},\"telephone\":\"+372 651 4550\"},{\"@type\":\"Place\",\"name\":\"SCN Oslo\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Kristoffer Robins vei 13\",\"addressLocality\":\"Oslo\",\"postalCode\":\"0978\",\"addressCountry\":\"NO\"},\"telephone\":\"+47 23 88 89 62\"},{\"@type\":\"Place\",\"name\":\"SCN R\u00f8dekro\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"H\u00e6rvejen 8\",\"addressLocality\":\"R\u00f8dekro\",\"postalCode\":\"6230\",\"addressCountry\":\"DK\"},\"telephone\":\"+45 78 74 65 00\"},{\"@type\":\"Place\",\"name\":\"SCN Madrid\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Paseo de la Castellana, 200\",\"addressLocality\":\"Madrid\",\"postalCode\":\"28046\",\"addressCountry\":\"ES\",\"addressRegion\":\"Comunidad de Madrid\"},\"telephone\":\"+34 93 641 59 97\"},{\"@type\":\"Place\",\"name\":\"SCN Tarnowskie G\u00f3ry\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"ul. Ma\u0142a 1B\",\"addressLocality\":\"Tarnowskie G\u00f3ry\",\"postalCode\":\"42-605\",\"addressCountry\":\"PL\"},\"telephone\":\"+48 511 199 460\"}],\"email\":\"sales@scn.eu\",\"areaServed\":[\"SE\",\"NO\",\"DK\",\"FI\",\"EE\",\"GB\",\"PL\",\"ES\"],\"knowsLanguage\":[\"en\",\"sv\",\"da\",\"fi\",\"nb\",\"et\",\"pl\",\"es\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cyber Resilience Act (CRA) \u2013 what the EU\u2019s new cyber rules mean for industrial networks | SCN","description":"What the EU Cyber Resilience Act requires of switches, routers and industrial computers, which dates apply and what to ask your supplier. A guide from SCN.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/","og_locale":"en_US","og_type":"article","og_title":"Cyber Resilience Act (CRA) \u2013 what the EU\u2019s new cyber rules mean for industrial networks | SCN","og_description":"What the EU Cyber Resilience Act requires of switches, routers and industrial computers, which dates apply and what to ask your supplier. A guide from SCN.","og_url":"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/","og_site_name":"SCN","article_modified_time":"2026-11-04T11:19:52+00:00","og_image":[{"width":1520,"height":500,"url":"https:\/\/scn.eu\/wp-content\/uploads\/2026\/11\/scn-guide-cra-f1-en.webp","type":"image\/webp"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/","url":"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/","name":"Cyber Resilience Act (CRA) \u2013 what the EU\u2019s new cyber rules mean for industrial networks | SCN","isPartOf":{"@id":"https:\/\/scn.eu\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/#primaryimage"},"image":{"@id":"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/#primaryimage"},"thumbnailUrl":"https:\/\/scn.eu\/wp-content\/uploads\/2026\/11\/scn-guide-cra-f1-en.webp","datePublished":"2026-11-04T11:19:38+00:00","dateModified":"2026-11-04T11:19:52+00:00","description":"What the EU Cyber Resilience Act requires of switches, routers and industrial computers, which dates apply and what to ask your supplier. A guide from SCN.","breadcrumb":{"@id":"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/#primaryimage","url":"https:\/\/scn.eu\/wp-content\/uploads\/2026\/11\/scn-guide-cra-f1-en.webp","contentUrl":"https:\/\/scn.eu\/wp-content\/uploads\/2026\/11\/scn-guide-cra-f1-en.webp","width":1520,"height":500,"caption":"Timeline for the Cyber Resilience Act: entry into force on 10 December 2024, rules for notified bodies from 11 June 2026, reporting of actively exploited vulnerabilities from 11 September 2026 and all requirements from 11 December 2027."},{"@type":"BreadcrumbList","@id":"https:\/\/scn.eu\/en\/guides\/cyber-resilience-act\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/scn.eu\/en\/"},{"@type":"ListItem","position":2,"name":"Cyber Resilience Act (CRA) \u2013 what the EU\u2019s new cyber rules mean for industrial networks"}]},{"@type":"WebSite","@id":"https:\/\/scn.eu\/en\/#website","url":"https:\/\/scn.eu\/en\/","name":"SCN","description":"","publisher":{"@id":"https:\/\/scn.eu\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/scn.eu\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/scn.eu\/en\/#organization","name":"Sensor Control Nordic","alternateName":"SCN","url":"https:\/\/scn.eu\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scn.eu\/en\/#\/schema\/logo\/image\/","url":"https:\/\/scn.eu\/wp-content\/uploads\/2026\/04\/SCN-logo-scaled.png","contentUrl":"https:\/\/scn.eu\/wp-content\/uploads\/2026\/04\/SCN-logo-scaled.png","width":2560,"height":632,"caption":"Sensor Control Nordic"},"image":{"@id":"https:\/\/scn.eu\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/sensor-control-nordic-ab"],"location":[{"@type":"Place","name":"SCN Walsall","address":{"@type":"PostalAddress","streetAddress":"46 Hall Lane, Walsall Wood","addressLocality":"Walsall","postalCode":"WS9 9DP","addressCountry":"GB","addressRegion":"West Midlands"},"telephone":"+44 1634 300 900"},{"@type":"Place","name":"SCN Stockholm","address":{"@type":"PostalAddress","streetAddress":"Gustav III:s Boulevard 32","addressLocality":"Solna","postalCode":"169 73","addressCountry":"SE"},"telephone":"+46 8 668 21 00"},{"@type":"Place","name":"SCN Malm\u00f6","address":{"@type":"PostalAddress","streetAddress":"R\u00f6nnviksgatan 13","addressLocality":"Malm\u00f6","postalCode":"213 74","addressCountry":"SE"},"telephone":"+46 40 688 02 00"},{"@type":"Place","name":"SCN Sundsvall","address":{"@type":"PostalAddress","streetAddress":"Trafikgatan 11","addressLocality":"Sundsvall","postalCode":"856 44","addressCountry":"SE"},"telephone":"+46 60 740 75 81"},{"@type":"Place","name":"SCN Helsinki","address":{"@type":"PostalAddress","streetAddress":"Huopalahdentie 24A","addressLocality":"Helsinki","postalCode":"00350","addressCountry":"FI"},"telephone":"+358 20 734 8600"},{"@type":"Place","name":"SCN Tallinn","address":{"@type":"PostalAddress","streetAddress":"Narva mnt 5","addressLocality":"Tallinn","postalCode":"10117","addressCountry":"EE"},"telephone":"+372 651 4550"},{"@type":"Place","name":"SCN Oslo","address":{"@type":"PostalAddress","streetAddress":"Kristoffer Robins vei 13","addressLocality":"Oslo","postalCode":"0978","addressCountry":"NO"},"telephone":"+47 23 88 89 62"},{"@type":"Place","name":"SCN R\u00f8dekro","address":{"@type":"PostalAddress","streetAddress":"H\u00e6rvejen 8","addressLocality":"R\u00f8dekro","postalCode":"6230","addressCountry":"DK"},"telephone":"+45 78 74 65 00"},{"@type":"Place","name":"SCN Madrid","address":{"@type":"PostalAddress","streetAddress":"Paseo de la Castellana, 200","addressLocality":"Madrid","postalCode":"28046","addressCountry":"ES","addressRegion":"Comunidad de Madrid"},"telephone":"+34 93 641 59 97"},{"@type":"Place","name":"SCN Tarnowskie G\u00f3ry","address":{"@type":"PostalAddress","streetAddress":"ul. Ma\u0142a 1B","addressLocality":"Tarnowskie G\u00f3ry","postalCode":"42-605","addressCountry":"PL"},"telephone":"+48 511 199 460"}],"email":"sales@scn.eu","areaServed":["SE","NO","DK","FI","EE","GB","PL","ES"],"knowsLanguage":["en","sv","da","fi","nb","et","pl","es"]}]}},"_links":{"self":[{"href":"https:\/\/scn.eu\/en\/wp-json\/wp\/v2\/scn_guide\/8246355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scn.eu\/en\/wp-json\/wp\/v2\/scn_guide"}],"about":[{"href":"https:\/\/scn.eu\/en\/wp-json\/wp\/v2\/types\/scn_guide"}],"author":[{"embeddable":true,"href":"https:\/\/scn.eu\/en\/wp-json\/wp\/v2\/users\/11"}],"version-history":[{"count":1,"href":"https:\/\/scn.eu\/en\/wp-json\/wp\/v2\/scn_guide\/8246355\/revisions"}],"predecessor-version":[{"id":8246369,"href":"https:\/\/scn.eu\/en\/wp-json\/wp\/v2\/scn_guide\/8246355\/revisions\/8246369"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scn.eu\/en\/wp-json\/wp\/v2\/media\/8246354"}],"wp:attachment":[{"href":"https:\/\/scn.eu\/en\/wp-json\/wp\/v2\/media?parent=8246355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}