1
Security by design
A product must be placed on the market without known exploitable vulnerabilities, with a secure default configuration and a reduced attack surface.
What the regulation says
Cyber Resilience Act requirements applied to applications
2
Vulnerability management
Manufacturers must detect, fix and document vulnerabilities throughout the support period, at least five years unless the product lifetime is shorter.
3
24-hour reporting
From 11 September 2026, any actively exploited vulnerability must be reported with an early warning within 24 hours, a notification within 72 hours and a final report, through the ENISA reporting platform.
4
Component inventory
Manufacturers must draw up a software bill of materials (SBOM), including third-party and open-source libraries, and make it available to authorities.
5
Protection against tampering
Products must protect the integrity of their code and data and resist unauthorised access.
How to comply
How to comply
The Cyber Resilience Act requires securing an application throughout its lifecycle: before release, then while in operation.
Source code analysis (SAST) detects vulnerabilities during development. Mobile Application Security Testing (MAST) analyses the applications' binary code and identifies their third-party components. In-App Protection, combining Shielding and RASP, hardens the code and detects exploitation attempts in real time once the application is published.
Related solutions