CPAN Security and Sustainability in light of the EU Cyber Resilience Act

[Article 64(4)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#064.004 'Supplying incorrect, incomplete or misleading information may be fined up to 5M EUR or 1% of global turnover'
[Article 13(18)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.018 'Manufacturers shall ensure products are accompanied by documentation listed in Annex II, and available for at least 10 years'
[Annex II]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#anx_II 'Information and Instructions to the User'

## CRA Fines

> Supplying <span style="color:darkred">**incorrect**</span>, <span style="color:darkred">**incomplete**</span> or <span style="color:darkred">**misleading**</span> information may be fined up to 5M EUR or 1% of global turnover

</div>
<div style="font-size: xx-large;">

> — Cyber Resilience Act, [Article 64(4)],<br> w.r.t. metadata described in [Annex II],<br> as required in [Article 13(18)]

</div>

Notes:

* There are more fines! See Article 64.

[Article 28(1)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#028.001 'Manufacturer states that cybersecurity requirements in [Annex I] has been demonstrated'
[Article 28(4)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#028.004 'Manufacturer assumes responsibility for compliance'
[Annex I]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#anx_I 'Essential Cybersecurity Requirements'

### Obligations of Manufacturers<br> — Conformance

![CE Mark](media/280px-Conformité_Européenne.png)

* Place a CE mark on the product
    * …stating cybersecurity requirements have been demonstrated
* Manufacturer assumes responsibility for compliance

> * [Article 28(1)] - …stating that cybersecurity requirements in [Annex I] has been demonstrated
> * [Article 28(4)] - Assume responsibility for compliance
> * [Annex I] - Cybersecurity requirements

</div>

Note:

* "I am following EU Law"
* "Presumption of Conformance" when following EU Standards

[Annex I, Part I]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#d1e47-68-1 'Cybersecurity requirements relating to the properties of products with digital elements'
[Annex III]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#anx_III 'Important products'
[Annex IV]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#anx_IV 'Critical products'

### Obligations of Manufacturers<br> — Conformance

[Article 7]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_7 'Important products'
[Article 8]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_8 'Critical products'
[Article 27]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_27 'Presumption of conformity'
[Article 32]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_32 'Conformity assessment procedures'

* Default: Self-assessment
* Open Source: Self-assessment
* Important:
  * Follow harmonized standards -> Presumption of conformance
  * 3rd-party assessment
* Critical: EU certification

> * [Article 32] - Conformity assessment procedures
> * [Article 7] - Important products
> * [Article 8] - Critical products
> * [Article 27] - Presumption of conformance
> * [Annex I, Part I] - Cybersecurity requirements
> * [Annex III] - Important products (Class I and II) examples
> * [Annex IV] - Critical products examples

</div>

Note:

* Self-assessment for most cases (~90%)
* "Presumption of Conformance" when following EU Standards
* Important I: Browsers; ID management; Virus scanners; Network management systems; OSes
* Important II: Hypervisors; Firewalls; Tamper-resistant microcontrollers
* Critical: Smartcards; Smart metering systems;

[Recital (65)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#rct_65 'Notify of severe incidents or actively exploited vulnerabilities'
[Article 13(1)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.002 'Manufacturers shall ensure products are developed in accordance with essential cybersecurity requirements'
[Article 13(2)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.002 'Manufacturers shall undertake a cybersecurity risk assessment'
[Article 13(5)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.005 'Manufacturers shall exercise due diligence when integrating components, including FOSS'
[Article 13(6)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.006 'Manufacturers shall share relevant code or documentation with the supplier or maintainer of the component'
[Annex I, Part I]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#d1e47-68-1 'Cybersecurity requirements relating to the properties of products with digital elements'

### — No Vulnerabilities

* Product is **secure by default**, and **secure by design**
* Product has **no known vulnerabilities**
* 😍 Exercise **due diligence** when integrating **third party components**
* 😍 **Report vulnerabilities** to the Manufacturer or **Open Source maintainer**

> * [Article 13(1)] – Develop in accordance with essential cybersecurity requirements
> * [Annex I, Part I] (2) (a) – without known exploitable vulnerabilities
> * [Article 13(5)] – Exercise due diligence when integrating, including FOSS
> * [Article 13(6)] – Share relevant code or documentation with the supplier or maintainer of the component
> * [Recital (65)] – Notify of severe incidents or actively exploited vulnerabilities

</div>

Note:

* Due diligence – to avoid or fix the components that compromise security

[Article 13(15)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.015 'Manufacturers shall ensure that their products is identifiable'
[Article 13(16)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.016 'Manufacturers shall indicate their name and identification'
[Article 13(17)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.017 'Manufacturers shall designate a single point of contact for reporting vulnerabilities'
[Article 14(1)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#014.001 'A manufacturer shall notify any actively exploited vulnerability contained in the product that it becomes aware of'

### — More!

* Manufacturer is clearly identified
* Single point of contact
* Product has a unique ID
* Take part in the EU early warning notification regime
* …

> * [Article 13(16)] – Manufacturer name
> * [Article 13(17)] – Single point of contact
> * [Article 13(15)] – Product ID
> * [Article 14(1)] – Notify of exploited vulnerabilities

</div>

[Article 24]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_24 'Obligations of open-source software stewards'
[Article 13(5)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.005 'Manufacturers shall exercise due diligence when integrating components, including FOSS'
[Article 15]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_15 'Voluntary reporting'
[Article 14(1)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#014.001 'A manufacturer shall notify any actively exploited vulnerability contained in the product that it becomes aware of'
[Article 14(3)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#014.003 'A manufacturer shall notify any severe incident having an impact on the security of the product that it becomes aware of'
[Article 14(8)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#014.008 'After becoming aware of an incident or vulnerability, the manufacturer shall inform the impacted users of the product, and about risk mitigation and any corrective measures that users can deploy'
[Article 24]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_24 'Obligations of open-source software stewards'
[Article 24]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_24 'Obligations of open-source software stewards'
[Article 24(2)]:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#024.002 'Open-source software stewards'

## OSS Stewards *are obliged to*…

* …facilitate Manufacturer's _due diligence_ obligations
* …provide a cybersecurity policy & documentation
* …cooperate with market surveillance authorities
* …notify designated CSIRT on…
  * actively exploited vulnerabilities
  * severe incidents
* …notify users on…
  * incidents and exploited vulnerabilities

> * [Article 24] – OSS Steward obligations
> * [Article 13(5)] – Due diligence obligations
> * [Article 15] – Security policy
> * [Article 24(2)] – Market surveillance authorities
> * [Article 14(1)] – Notify on exploited vulnerabilities
> * [Article 14(3)] – Notify market authorities on any severe incidents
> * [Article 14(8)] – Notify users on actively exploited vulnerabilities

</div>

Notes:

* …cybersecurity policy for **voluntary reporting of vulnerabilities**
* …notify designated CSIRT **to the extent the Steward is involved**