Cyber Resilience Act

[plehegar]

Describe the problem you think needs solving

The Cyber Resilience Act enhances cybersecurity standards of products that contain a digital component, requiring manufacturers and retailers to ensure cybersecurity throughout the lifecycle of their products.
The Cyber Resilience Act entered into force on 10 December 2024. The main obligations introduced by the Act will apply from 11 December 2027.

W3C needs to figure out how this will affect us.

cc @rigow

[rigow]

Permanent link to CRA is in Eur-Lex. Main issue is dealing with open source stewards according to Art. 24 of the CRA. We also need to find out whether the making of common technical specifications is affected. This touches on security by design paradigm

[rigow]

Presentation in https://www.w3.org/2025/04/CRA-Strat-Presentation.pdf Discussion of the Topic in Strat-Call 2025-04-22

[plehegar]

3 dimensions to look at:

1. security by design: improving our security and privacy considerations with a risk-based approach (threat modelling).
2. security updates and vulnerability handling: Have SING take over "W3C Security Disclosures Best Practices", add security issues handling to it, and publish as a Group Note.
3. Cooperation with ESOs on assessment criteria for browsers as well as mobile web applications

[simoneonofri]

Added a reflection here: #503 (comment)

[plehegar]

SWAG is looking at this.