Skip to content

Commit 5eea187

Browse files
kartbenkartben
committed
doc: security: standards: add EU Cyber Resilience Act (CRA) FAQ
Add comprehensive FAQ documentation explaining how the EU Cyber Resilience Act relates to both manufacturers using Zephyr in commercial products and to the Zephyr Project as an open-source software steward. Fixes #83964 Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
1 parent b7eef5f commit 5eea187

File tree

3 files changed

+360
-0
lines changed

3 files changed

+360
-0
lines changed

‎doc/security/security-citations.rst‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,3 +47,8 @@ Security Document Citations
4747
4848
.. [CIIBPB] Core Infrastructure Initiative Best Practices Badge. [Online].
4949
Available: https://github.com/linuxfoundation/cii-best-practices-badge
50+
51+
.. [CRA24] Regulation (EU) 2024/2847 of the European Parliament and of the Council
52+
of 23 October 2024 on horizontal cybersecurity requirements for products with
53+
digital elements (Cyber Resilience Act). [Online].
54+
Available: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847

‎doc/security/standards/cyber-resilience-act.rst‎

Lines changed: 354 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,354 @@
1+
.. _cra_faq:
2+
3+
EU Cyber Resilience Act (CRA)
4+
#############################
5+
6+
.. warning::
7+
This document is for informational purposes only and does not constitute legal advice.
8+
Consult with competent legal counsel for compliance guidance specific to your situation.
9+
10+
Overview
11+
********
12+
13+
The Cyber Resilience Act ([CRA24]_) is an EU regulation that establishes cybersecurity requirements for
14+
products with digital elements (PDEs) placed on the EU market.
15+
It entered into force on December 10, 2024.
16+
17+
.. admonition:: Key Dates
18+
:class: important
19+
20+
* **June 11, 2026**: Assessment bodies operational
21+
* **September 11, 2026**: Manufacturers must report vulnerabilities and incidents
22+
* **December 11, 2027**: Full regulation applies
23+
24+
This FAQ explains how the Cyber Resilience Act relates both to manufacturers using Zephyr in
25+
commercial products and to the Zephyr Project itself in its role as an open-source software steward.
26+
27+
For Manufacturers Using Zephyr
28+
******************************
29+
30+
Does the CRA apply to my product?
31+
=================================
32+
33+
The CRA applies if you place a product with digital elements (PDE) on the EU market for commercial
34+
purposes. This includes hardware devices with embedded software, and standalone software products.
35+
36+
Which category does my product belong to?
37+
=========================================
38+
39+
The CRA classifies products into categories based on risk: **Important Products** (`Annex III`_) and
40+
**Critical Products** (`Annex IV`_). Products not listed in either category are considered
41+
**Default** products and have lower requirements.
42+
43+
For example, default products can typically rely on self-assessment (see :ref:`compliance_path`)
44+
with fewer documentation and assurance requirements.
45+
46+
.. list-table::
47+
:header-rows: 1
48+
:widths: 15 25 60
49+
50+
* - Category
51+
- Short description
52+
- Example Zephyr Use Cases
53+
* - Default
54+
- Products with digital elements that are not listed as "important" or "critical".
55+
- - Wi-Fi smart bulb or switch (e.g., running Matter over Thread/Wi-Fi).
56+
- Wearable activity tracker or smartwatch for personal wellness.
57+
- Bluetooth LE audio accessory or wireless sensor tag.
58+
* - Important (Class I)
59+
- Higher-risk products, often consumer-facing, performing security- or access-relevant
60+
functions.
61+
- - Smart door lock or access control reader for residential use.
62+
- Smart home hub or router managing network traffic.
63+
- Connected alarm system or security sensor.
64+
* - Important (Class II)
65+
- Higher-risk products used in enterprise/industrial/infra contexts or with privileged network
66+
roles.
67+
- - Industrial Programmable Logic Controller (PLC) or robot controller.
68+
- Micro-controllers with Secure Enclave/TEEs used for device identity.
69+
- Industrial IoT gateway performing edge processing.
70+
* - Critical
71+
- Products whose compromise could severely impact critical infrastructure or essential
72+
services.
73+
- - Smart electricity meter or water meter with remote shut-off.
74+
- Hardware Security Module (HSM) or smartcard firmware.
75+
- Safety-critical sensors used in energy or transport grids.
76+
77+
.. admonition:: Core Functionality vs. Integration
78+
:class: important
79+
80+
Classification is determined by the **core functionality** of the final product, not by the
81+
individual components it integrates (`Article 7`_).
82+
83+
* If you build a network firewall using Zephyr, the core function is security, making the
84+
product an Important Product (Class II).
85+
* If you build a coffee machine using Zephyr, and you utilize Zephyr's networking stack features
86+
protect the device, the core function remains making coffee. This is a "default" product.
87+
88+
In a nutshell, using security-critical Zephyr features (like cryptography or secure boot) in a
89+
device does **not** elevate that device to a higher risk class.
90+
91+
For detailed classification, see `Annex III`_ and `Annex IV`_.
92+
93+
.. _compliance_path:
94+
95+
Which compliance path must I choose?
96+
====================================
97+
98+
The CRA defines different conformity assessment procedures based on your product category.
99+
You must choose the path that corresponds to your classification and reliance on harmonized
100+
standards.
101+
102+
.. list-table:: CRA Product Categories & Assessment Routes
103+
:widths: 20 55 25
104+
:header-rows: 1
105+
106+
* - Category
107+
- Conformity Assessment Procedure
108+
- Third-Party Audit?
109+
* - Default
110+
- Module A (Internal Control). Self-assessment by the manufacturer.
111+
- No
112+
* - Important Class I
113+
- Module A **ONLY IF** harmonized standards are fully applied. Otherwise: Module B + Module C,
114+
or Module H.
115+
- Yes, if standards not fully used
116+
* - Important Class II
117+
- Module B + Module C, or Module H. (Self-assessment is **NOT** allowed).
118+
- Yes (Mandatory)
119+
* - Critical
120+
- **European Cybersecurity Certification** (e.g., EUCC) or Module B + Module C + Module H
121+
(pending delegate acts).
122+
- Yes (Mandatory)
123+
124+
The "Modules" refer to specific assessment procedures defined in `Decision No 768/2008/EC`_
125+
("New legislative framework") and adapted by the CRA in `Annex VIII`_:
126+
127+
* `Module A`_ (Internal production control): You create the technical documentation, perform the
128+
risk assessment, and declare conformity yourself. No external auditor is required.
129+
* `Module B`_ (EC-type examination) + `Module C`_ (Conformity to type): A Notified Body [#nb]_
130+
examines the technical design (Module B) and issues a certificate. You then ensure production
131+
conforms to that type (Module C).
132+
* `Module H`_ (Full Quality Assurance): A Notified Body [#nb]_ audits your Quality Management System
133+
(QMS) governing design, production, and testing.
134+
135+
.. [#nb] Notified Bodies will become operational by **June 11, 2026**.
136+
137+
What are my main obligations as a manufacturer?
138+
===============================================
139+
140+
Regardless of a product's classification, the following core obligations apply to all manufacturers
141+
of products with digital elements.
142+
143+
**Risk assessment**
144+
Assess and document cybersecurity risks throughout the product lifecycle.
145+
146+
**Due diligence**
147+
Exercise due diligence when integrating third-party components (including open-source software
148+
like Zephyr).
149+
150+
**Vulnerability handling**
151+
Handle vulnerabilities for at least 5 years (support period), including receiving reports and
152+
applying updates.
153+
154+
**Incident reporting**
155+
Report actively exploited vulnerabilities and severe incidents to the relevant CSIRT and ENISA.
156+
157+
**Technical documentation**
158+
Create documentation per `Article 31`_ and `Annex VII`_.
159+
160+
**Conformity assessment**
161+
Assess conformity per `Article 32`_ and `Annex VIII`_.
162+
163+
**CE marking**
164+
Affix CE mark and draw up EU declaration of conformity.
165+
166+
What are the penalties for non-compliance?
167+
==========================================
168+
169+
* Up to **EUR 15,000,000 or 2.5%** of worldwide annual turnover (`Article 13`_ & `Article 14`_
170+
violations).
171+
* Up to **EUR 10,000,000 or 2%** of turnover (violations of other obligations).
172+
173+
What Zephyr features help with CRA compliance?
174+
==============================================
175+
176+
Zephyr provides several features to support manufacturers in meeting these obligations.
177+
178+
Software Bill of Materials (SBOM)
179+
Automatically generate SPDX-compliant (inc. ISO/IEC 5962:2021) SBOMs during build.
180+
See :ref:`west-spdx` for details.
181+
182+
Secure boot and updates
183+
* :ref:`ota` support.
184+
185+
:ref:`cryptography`
186+
* Hardware-backed crypto APIs.
187+
* :ref:`psa_crypto` support.
188+
* :ref:`Trusted Firmware <tfm>` integration for attestation and secret management.
189+
190+
:ref:`Long-Term Support (LTS) <release_process_lts>` with 5-year support period.
191+
192+
:ref:`Vulnerability tracking <reporting>`
193+
* `Vulnerability Alert Registry <https://zephyrproject.org/vulnerability-alert-registry/>`_.
194+
* Receive early notifications during Zephyr's 90-day embargo window.
195+
* CVEs tracked at `CVE Details <https://www.cvedetails.com/vendor/19255/Zephyrproject.html>`_.
196+
197+
Quality assurance
198+
* Continuous integration.
199+
* Coding guidelines
200+
* Static code analysis
201+
* Automated code quality checks on every pull request.
202+
* OpenSSF Best Practices Gold Badge.
203+
204+
How do I handle Zephyr vulnerabilities?
205+
=======================================
206+
207+
1. **Register**: Sign up for Zephyr's `Vulnerability Alert Registry`_.
208+
2. **Monitor**: Receive notifications when vulnerabilities are discovered.
209+
3. **Assess**: Evaluate impact on your product (consider your configuration/Kconfig).
210+
4. **Update**: Apply fixes from LTS branches.
211+
5. **Report**: If the vulnerability affects your product and is actively exploited, report per
212+
`Article 14`_ timelines.
213+
214+
**Zephyr's vulnerability handling timeline:**
215+
216+
* **7 days**: PSIRT feedback to reporter.
217+
* **14 days**: Manufacturers notified via alert registry.
218+
* **30 days**: Fix available from Zephyr project.
219+
* **60 days**: Additional time for manufacturers before public disclosure.
220+
221+
What are the deadlines for reporting vulnerabilities?
222+
=====================================================
223+
224+
If you detect an actively exploited vulnerability or a severe incident, you must report it according
225+
to strict timelines:
226+
227+
* **24 hours**: Early warning notification to CSIRT/ENISA.
228+
* **72 hours**: Vulnerability notification with general information.
229+
* **14 days**: Final report after corrective measures are available.
230+
231+
Must I report vulnerabilities I find in Zephyr?
232+
===============================================
233+
234+
**Yes**, under `Article 13(6)`_, if you discover a vulnerability in a component (including Zephyr),
235+
you **must** report it to the entity maintaining it. See :ref:`reporting`.
236+
237+
Additionally, consider voluntary reporting to CSIRT or ENISA per `Article 15`_.
238+
239+
For Zephyr as an Open Source Steward
240+
************************************
241+
242+
What is Zephyr's role under the CRA?
243+
====================================
244+
245+
Zephyr is an **"open-source software steward"** under `Article 3`_ (14): a legal person that
246+
systematically provides sustained support for developing PDEs intended for commercial activities.
247+
248+
Zephyr's obligations under Article 24:
249+
250+
**Cybersecurity policy**
251+
Document security policies and vulnerability handling.
252+
253+
**Cooperation**
254+
Work with market surveillance authorities to mitigate risks.
255+
256+
**Incident reporting**
257+
Report actively exploited vulnerabilities and severe incidents affecting Zephyr's infrastructure
258+
(to the extent Zephyr is involved).
259+
260+
Does the CRA apply to Zephyr contributors?
261+
==========================================
262+
263+
**No.** The CRA does not apply to individual contributors to Zephyr (`Recital 18`_).
264+
265+
Contributors developing features or fixing bugs are not subject to CRA obligations.
266+
267+
How is Zephyr meeting its steward obligations?
268+
==============================================
269+
270+
`Article 24(1)`_: Security policy (Complete)
271+
* Documented at :ref:`security-overview`
272+
* Vulnerability reporting process: :ref:`reporting`
273+
* Secure coding guidelines: :ref:`secure code`
274+
275+
`Article 24(2)`_: Cooperation with authorities (In Progress)
276+
* Registered CVE Numbering Authority (CNA) since 2017
277+
* Active Zephyr Project Security Incident Response Team (PSIRT)
278+
* **In Progress**: Identifying CSIRT coordinator for EU
279+
280+
`Article 14(1)`_ & `Article 14(3)`_: Incident reporting (In Progress)
281+
* **In Progress**: Determining if NVD processes work for CSIRT/ENISA reporting
282+
* Plan to align with EU reporting requirements
283+
284+
`Article 14(8)`_: User notification (Complete)
285+
* Vulnerability Alert Registry for manufacturers and integrators
286+
* CVE publication and security advisories
287+
288+
`Article 52(3)`_: Corrective actions (Complete)
289+
* Established processes in place with CVE authorities
290+
* Timely response through PSIRT
291+
292+
External Resources
293+
******************
294+
295+
Official CRA documentation
296+
==========================
297+
298+
* `EU CRA Regulation 2024/2847
299+
<https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847>`_
300+
* `ENISA CRA Requirements-Standards Mapping
301+
<https://www.enisa.europa.eu/publications/cyber-resilience-act-requirements-standards-mapping>`_
302+
303+
Educational resources
304+
=====================
305+
306+
* `Linux Foundation: Understanding the EU CRA
307+
<https://training.linuxfoundation.org/express-learning/understanding-the-eu-cyber-resilience-act-cra-lfel1001>`_
308+
* `Linux Foundation CRA Readiness Report <https://www.linuxfoundation.org/research/cra-readiness>`_
309+
* `Linux Foundation CRA Compliance Best Practices
310+
<https://www.linuxfoundation.org/research/cra-compliance-best-practices>`_
311+
* `OpenSSF CRA Guidance <https://openssf.org/cra/>`_
312+
313+
Zephyr-specific resources
314+
=========================
315+
316+
* :ref:`security-overview`
317+
* :ref:`reporting`
318+
* `Vulnerability Alert Registry <https://zephyrproject.org/vulnerability-alert-registry/>`_
319+
* :ref:`Zephyr Vulnerabilities <vulnerabilities>`
320+
321+
..
322+
323+
.. _`Decision No 768/2008/EC`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32008D0768
324+
.. _`Module A`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32008D0768#d1e41-98-1
325+
.. _`Module B`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32008D0768#d1e288-98-1
326+
.. _`Module C`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32008D0768#d1e439-98-1
327+
.. _`Module H`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32008D0768#d1e1719-98-1
328+
329+
.. _`CRA Requirements-Standards Mapping`: https://www.enisa.europa.eu/publications/cyber-resilience-act-requirements-standards-mapping
330+
331+
.. _`Recital 18`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#rct_18
332+
333+
.. _`Article 3`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_3
334+
.. _`Article 7`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_7
335+
.. _`Article 13`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_13
336+
.. _`Article 13(6)`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.006
337+
.. _`Article 13(14)`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#013.014
338+
.. _`Article 14`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_14
339+
.. _`Article 14(1)`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#014.001
340+
.. _`Article 14(3)`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#014.003
341+
.. _`Article 14(8)`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#014.008
342+
.. _`Article 15`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_15
343+
.. _`Article 24(1)`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#024.001
344+
.. _`Article 24(2)`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#024.002
345+
.. _`Article 31`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_31
346+
.. _`Article 32`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#art_32
347+
.. _`Article 52(3)`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#052.003
348+
349+
.. _`Annex III`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#anx_III
350+
.. _`Annex IV`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#anx_IV
351+
.. _`Annex VII`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#anx_VII
352+
.. _`Annex VIII`: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202402847#anx_VIII
353+
354+
.. _`Vulnerability Alert Registry`: https://zephyrproject.org/vulnerability-alert-registry/

‎doc/security/standards/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,5 @@ needed to build certifiable, compliant products using Zephyr.
1515
.. toctree::
1616
:maxdepth: 1
1717

18+
cyber-resilience-act.rst
1819
etsi-303645.rst

0 commit comments

Comments
 (0)