Skip to content

standards.md

Latest commit

 

History

History
65 lines (56 loc) · 9.1 KB

standards.md

File metadata and controls

65 lines (56 loc) · 9.1 KB

Summary of European Commission implementing decision of a standardisation request to the ESOs

This is a summary of the European Commission implementing decision of a standardisation request to the ESOs of February 2, 2025 (PDFs: act, annexes).

Milestone 1 - Horizontal standards due August 30, 2026

Number Description CRA Link CEN/CENELEC ETSI
1 designing, developing and producing products with digital elements in such a way that they ensure an appropriate level of cybersecurity based on the risks Annex I, Part I, point (1) WG9 PT1 -
15 vulnerability handling for products with digital elements Annex I, Part II WG9 PT3 -

Milestone 2 - Vertical standards due October 30, 2026

These standards describe essential cybersecurity requirements for the Important Products listed in Annex III and the Critical Products listed in Annex IV.

Number Description CRA Link CEN/CENELEC ETSI
16 identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers Annex III, Class I, point (1) TBD TBD
17 standalone and embedded browsers Annex III, Class I, point (2) TBD TBD
18 password managers Annex III, Class I, point (3) TBD TBD
19 software that searches for, removes, or quarantines malicious software Annex III, Class I, point (4) TBD TBD
20 products with digital elements with the function of virtual private network (VPN) Annex III, Class I, point (5) TBD TBD
21 network management systems Annex III, Class I, point (6) TBD TBD
22 Security information and event management (SIEM) systems Annex III, Class I, point (7) TBD TBD
23 boot managers Annex III, Class I, point (8) TBD TBD
24 public key infrastructure and digital certificate issuance software Annex III, Class I, point (9) TBD TBD
25 physical and virtual network interfaces Annex III, Class I, point (10) TBD TBD
26 operating systems Annex III, Class I, point (11) TBD TBD
27 routers, modems intended for the connection to the internet, and switches Annex III, Class I, point (12) TBD TBD
28 microprocessors with security-related functionalities Annex III, Class I, point (13) TBD TBD
29 microcontrollers with security-related functionalities Annex III, Class I, point (14) TBD TBD
30 application specific integrated circuits (AS IC) and field-programmable gate arrays (FPGA) with security-related functionalities Annex III, Class I, point (15) TBD TBD
31 smart home general purpose virtual assistants Annex III, Class I, point (16) TBD TBD
32 smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems Annex III, Class I, point (17) TBD TBD
33 Internet connected toys covered by Directive 2009/48/EC that have social interactive features (e.g. speaking or filming) or that have location tracking features Annex III, Class I, point (18) TBD TBD
34 personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or Regulation (EU) 2017/746 do not apply or personal wearable products that are intended for the use by and for children Annex III, Class I, point (19) TBD TBD
35 hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments Annex III, Class II, point (1) TBD TBD
36 firewalls, intrusion detection and/or prevention systems, including specifically those intended for industrial use Annex III, Class II, point (2) TBD TBD
37 tamper-resistant microprocessors Annex III, Class II, point (3) TBD TBD
38 tamper-resistant microcontrollers Annex III, Class II, point (4) TBD TBD
39 Hardware Devices with Security Boxes Annex IV, point (1) TBD -
40 smart meter gateways within smart metering systems as defined in Article 2 (23) of Directive (EU) 2019/944 and other devices for advanced security purposes, including for secure cryptoprocessing Annex IV, point (2) TBD -
41 smartcards or similar devices, including secure elements Annex IV, point (3) TBD -

Milestone 3 - Horizontal standards due October 30, 2027

Number Description CRA Link CEN/CENELEC ETSI
2 making products with digital elements available on the market without known exploitable vulnerabilities Annex I, Part I, point (2)⁠(a) WG9 PT2 -
3 making products with digital elements available on the market with a secure by default configuration Annex I, Part I, point (2)⁠(b) WG9 PT2 -
4 ensuring that vulnerabilities in products with digital elements can be addressed through security updates Annex I, Part I, point (2)⁠(c) WG9 PT2 -
5 ensuring protection of products with digital elements from unauthorised access and reporting on possible unauthorised access Annex I, Part I, point (2)⁠(d) WG9 PT2 -
6 protecting the confidentiality of data stored, transmitted or otherwise processed by a product with digital elements Annex I, Part I, point (2)⁠(e) WG9 PT2 -
7 protecting the integrity of data, commands, programs by a product with digital elements, and its configuration against any manipulation or modification not authorised by the user, as well as reporting on corruptions Annex I, Part I, point (2)⁠(f) WG9 PT2 -
8 processing only personal or other data that are adequate, relevant and limited to what is necessary in relation to the intended purpose of the product with digital elements (‘minimisation of data’) Annex I, Part I, point (2)⁠(g) WG9 PT2 -
9 protecting the availability of essential and basic functions of the product with digital elements Annex I, Part I, point (2)⁠(h) WG9 PT2 -
10 minimising the negative impact of a product with digital elements or its connected devices on the availability of services provided by other devices or networks Annex I, Part I, point (2)⁠(i) WG9 PT2 -
11 designing, developing and producing products with digital elements with limitted attack surfaces Annex I, Part I, point (2)⁠(j) WG9 PT2 -
12 designing, developing and producing products with digital elements that reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques Annex I, Part I, point (2)⁠(k) WG9 PT2 -
13 providing security related information by recording and/or monitoring relevant internal activity of products with digital elements with an opt-out mechanism for the user Annex I, Part I, point (2)⁠(l) WG9 PT2 -
14 securely and easily removing or transferring all data and settings of a product with digital elements Annex I, Part I, point (2)⁠(m) WG9 PT2 -