The EU have proposed the introduction of a new Cyber Resliance Act. It will create regulation for Manufacturers that build digital products or products with digital elements and bolsters rules to ensure more secure hardware and software products.
We all know that cyber attacks are becoming increasingly more successful, with the estimated global annual cost of cybercrime of €5.5 trillion by 2021.
While existing internal market legislation applies to certain products with digital elements, most of the hardware and software products are currently not covered by any EU legislation tackling their cybersecurity. In particular, the current EU legal framework does not address the cybersecurity of non-embedded software, even if cybersecurity attacks increasingly target vulnerabilities in these products, causing significant societal and economic costs.
Two main objectives were identified aiming to ensure the proper functioning of the internal market:
- create conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and ensure that manufacturers take security seriously throughout a product’s life cycle; and
- create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements.
Four specific objectives were set out:
- ensure that manufacturers improve the security of products with digital elements since the design and development phase and throughout the whole life cycle;
- ensure a coherent cybersecurity framework, facilitating compliance for hardware and software producers;
- enhance the transparency of security properties of products with digital elements, and
- enable businesses and consumers to use products with digital elements securely.
Find out more here: https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act
It's coming out of the EU, so yet to see what impact it will have here.