Cyber Resilience Act
 | |
| Title | Cyber Resilience Act – Proposal for a regulation on cybersecurity requirements for products with digital elements |
|---|---|
| Pending legislation | |
The Cyber Resilience Act (CRA) is an EU regulation proposed on 15 September 2022 by the European Commission for improving cybersecurity and cyber resilience in the EU through common cybersecurity standards for products with digital elements in the EU, such as required incident reports and security updates.[1] Products with digital elements mainly are hardware and software whose "intended and foreseeable use includes direct or indirect data connection to a device or network".[2]
After publication of the draft proposal, multiple open source organizations criticized CRA for creating a "chilling effect on open source software development".[3] The European Commission reached political agreement of the CRA on 1 December 2023, after a series of amendments.[4] The revised bill received relief and applause from many open source organizations, and introduced the "open source steward", a new economic concept.[5] The CRA agreement received formal approval by the European Parliament in March 2024 and still requires formal adoption by the Council before being enforced.[6] Some open-source parties like the Debian project remain critical of the proposed regulation.[7]
Purposes and motivations[edit]
The background, purposes and motivations for the proposed policy include:[8]
- Consumers increasingly become victims to security flaws of digital products (e.g. vulnerabilities), including of Internet of Things devices[2][9][10] or smart devices.[11][12]
- Ensuring that digital products in the supply chain are secure is important for businesses,[2] and cybersecurity often is a "full company risk issue".[13]
- Potential impacts of hacking include "severe disruption of economic and social activities across the internal market, undermining security or even becoming life-threatening".[14]
- Secure by default principles would impose a duty of care for the lifecycle of products, instead of e.g. relying on consumers and volunteers to establish a basic level of security.[2][15] The new rules would "rebalance responsibility towards manufacturers".[14]
- Cyberattacks have led "to an estimated global annual cost of cybercrime of €5.5 trillion by 2021".[1]
- The rapid spread of digital technologies means rogue states or non-state groups could more easily disrupt critical infrastructures such as public administration and hospitals.[16]
According to The Washington Post, the CRA could make the EU a leader on cybersecurity and "change the rules of the game globally".[15]
Implementation and mechanisms[edit]
 | This section needs to be updated. The reason given is: Copyedit and remove "will" for things that have happened. Also add the newer amendment that only applies this to commercial distribution. (February 2024) |
The policy requires software that are "reasonably expected" to have automatic updates should roll out security updates automatically by default while allowing users to opt out.[17] When feasible, security updates should be separated from feature updates.[18]: Annex I.II(2) Companies need to conduct cyber risk assessments before a product is put on the market and throughout 10 years or its expected lifecycle.[19] Companies would have to notify EU cybersecurity agency ENISA of any incidents within 24 hours of becoming aware of them, and take measures to resolve them.[12] Products carrying the CE marking would "meet a minimum level of cybersecurity checks".[9]
About 90% of products with digital elements fall under a default category, for which manufacturers will self-assess security, write an EU declaration of conformity, and provide technical documentation.[20] The rest are either "important" or "critical". Security-important products are categorized into two classes of risks.[21] Products assessed as 'critical' will need to undergo external audits.[17][15]
Once the law has passed, manufacturers would have two years to adapt to the new requirements and one year to implement vulnerability and incident reporting. Failure to comply could result in fines of up to €15 million or 2.5 percent of the offender's total worldwide annual turnover for the preceding financial year.[14][11][12] Fines do not apply to non-commercial open-source developers.[18]: 64(10)
Euractiv has reported on novel drafts or draft-changes that includes changes like the "removal of time obligations for products' lifetime and limiting the scope of reporting to significant incidents".[22][17] The first compromise amendment will be discussed on 22 May 2023 until which groups reportedly could submit written comments. Euractiv has provided a summary overview of the proposed changes.[23]
The main political groups in the European Parliament are expected to agree on the Cyber Resilience Act at a meeting on 5 July 2023. Lawmakers will discuss open source considerations, support periods, reporting obligations, and the implementation timeline. The committee vote is scheduled for 19 July 2023.[24][25]
The Spanish presidency of the EU Council has released a revised draft that simplifies the regulatory requirements for connected devices. It would reduce the number of product categories that must comply with specific regulations, mandate reporting of cybersecurity incidents to national CSIRTs, and include provisions for determining product lifetime and easing administrative burdens for small companies. The law also clarifies that spare parts with digital elements supplied by the original manufacturer are exempt from the new requirements.[26][25]
The Council text further stipulates that prior to seeking compulsory certification, the European Union executives must undertake an impact assessment to evaluate both the supply and demand aspects of the internal market, as well as the member states' capacity and preparedness for implementing the proposed schemes.[27][25]
Reception[edit]
Initially, the proposed act was heavily criticized by open-source advocates.[28]
- Multiple open source organizations like the Eclipse Foundation, the Open Source Initiative (OSI), and The Document Foundation have signed the open letter "Open Letter to the European Commission on the Cyber Resilience Act",[29] asking policy-makers to change the under-representation of the open source community. It finds that with the policy "[free and open source software,] more than 70% of the software in Europe[,] is about to be regulated without an in-depth consultation" and if implemented as written (as of April) would have a "chilling effect on open source software development as a global endeavour, with the net effect of undermining the EU's own expressed goals for innovation, digital sovereignty, and future prosperity".[3][28][29] The Apache Software Foundation published a similar statement,[30] and the OSI submitted this information to the European Commission's request for input.[31]
- Although Mozilla "welcome[s] and support[s] the overarching goals of the CRA", it also criticised the proposal for unclear references to "commercial activity" that could include many open source projects (a viewpoint Ilkka Turunen of Computer Weekly repeated[32]), misalignment with other EU rules, and requirements for the disclosure of unmitigated vulnerabilities.[33]
- Steven J. Vaughan-Nichols of The Register argued the CRA's "underlying assumption is that you can just add security to software" while "[m]any open source developers have neither the revenue nor resources to secure their programs to a government standard".[28]
- CCIA Europe warned that "the resulting red tape from the approval process could hamper the roll-out of new technologies and services in Europe".[12]
Amendments were released on 1 December 2023, as part of political agreement between co-legislators,[34] to the acclaim of many open-source advocates.[5] As Mike Milinkovich, executive director of the Eclipse foundation,[35] wrote:[34]
The revised legislation has vastly improved its exclusion of open source projects, communities, foundations, and their development and package distribution platforms. It also creates a new form of economic actor, the “open source steward,” which acknowledges the role played by foundations and platforms in the open source ecosystem. This is the first time this has appeared in a regulation, and it will be interesting to see how this evolves.
— Mike Milinkovich, "Good News on the Cyber Resilience Act"
The OSI noted Debian's statement that many small businesses and solo developers would be put out of business by the act[7] remained unaddressed.[5]
See also[edit]
- Artificial Intelligence Act
- Consumer protection
- Cyber self-defense
- List of data breaches
- List of security hacking incidents#2023
- Sustainable design
- Standardization
References[edit]
- ^ a b "Cyber Resilience Act | Shaping Europe's digital future". digital-strategy.ec.europa.eu. 15 September 2022. Retrieved 17 May 2023.
- ^ a b c d "EU cyber-resilience act | Think Tank | European Parliament". www.europarl.europa.eu. Retrieved 17 May 2023.
- ^ a b Sawers, Paul (18 April 2023). "In letter to EU, open source bodies say Cyber Resilience Act could have 'chilling effect' on software development". TechCrunch. Retrieved 17 May 2023.
- ^ "Commission welcomes political agreement on Cyber Resilience Act". European Commission. 1 December 2023. Retrieved 22 March 2024.
- ^ a b c Phipps, Simon (2 February 2024), "The European regulators listened to the Open Source communities!", Voices of Open Source, Open Source Initiative, retrieved 21 February 2024
- ^ "Cyber Resilience Act: MEPs adopt plans to boost security of digital products | News | European Parliament". www.europarl.europa.eu. 12 March 2024. Retrieved 23 March 2024.
- ^ a b Statement about the EU Cyber Resilience Act
- ^ Car, Polona; De Luca, Stefano (May 2023). EU cyber-resilience act — Briefing EU Legislation in Progress — PE 739.259. Strasbourg, France: European Parliamentary Research Service (EPRS), European Parliament. Retrieved 25 September 2023.
- ^ a b "EU pitches cyber law to fix patchy Internet of Things". POLITICO. 15 September 2022. Retrieved 17 May 2023.
- ^ "Commission presents Cyber Resilience Act targeting Internet of Things products". www.euractiv.com. 15 September 2022. Retrieved 17 May 2023.
- ^ a b Lomas, Natasha (15 September 2022). "The EU unboxes its plan for smart device security". TechCrunch. Retrieved 17 May 2023.
- ^ a b c d Chee, Foo Yun (15 September 2022). "EU proposes rules targeting cybersecurity risks of smart devices". Reuters. Retrieved 17 May 2023.
- ^ Gross, Anna (9 November 2022). "Why a clear cyber policy is critical for companies". Financial Times. Retrieved 17 May 2023.
- ^ a b c Dobberstein, Laura. "EU puts manufacturers on hook for smart device security". www.theregister.com. Retrieved 17 May 2023.
- ^ a b c Starks, Tim (3 January 2023). "Analysis | Europe's cybersecurity dance card is full". Washington Post. Retrieved 17 May 2023.
- ^ "EU chief announces cybersecurity law for connected devices". www.euractiv.com. 16 September 2021. Retrieved 17 May 2023.
- ^ a b c "Swedish Council presidency presents first full rewrite of Cyber Resilience Act". www.euractiv.com. 25 April 2023. Retrieved 17 May 2023.
- ^ a b Texts adopted - Cyber Resilience Act, European Parliament, 12 March 2024, retrieved 23 March 2024
- ^ Security, Help Net (2 March 2023). "Cyber resilience in focus: EU act to set strict standards". Help Net Security. Retrieved 18 May 2023.
- ^ Nuthi, Kir (26 September 2022), An Overview of the EU's Cyber Resilience Act, Center for Data Innovation, retrieved 23 March 2024
- ^ "Cyber-resilience Act signals big change in commercial software development". The Irish Times. Retrieved 17 May 2023.
- ^ "Cyber Resilience Act: Leading MEP proposes flexible lifetime, narrower reporting". www.euractiv.com. 31 March 2023. Retrieved 17 May 2023.
- ^ "EU lawmakers kick off cybersecurity law negotiations for connected devices". www.euractiv.com. 17 May 2023. Retrieved 18 May 2023.
- ^ "EU lawmakers set to close deal on cybersecurity law for connected devices". www.euractiv.com. 4 July 2023. Retrieved 6 July 2023.
- ^ a b c "Cyber Resilience Act – Read the current state of play". Cyber Resilience Act. Retrieved 13 July 2023.
- ^ "EU Council cuts down special product categories in cybersecurity law". www.euractiv.com. 10 July 2023. Retrieved 13 July 2023.
- ^ "EU ambassadors set to endorse new cybersecurity law for connected devices". www.euractiv.com. 17 July 2023. Retrieved 20 July 2023.
- ^ a b c Vaughan-Nichols, Steven J. "EU attempts to secure software could hurt open source". www.theregister.com. Retrieved 17 May 2023.
- ^ a b Harris, Jacob (17 April 2023). "Open Letter to the European Commission on the Cyber Resilience Act". Eclipse News, Eclipse in the News, Eclipse Announcement. Retrieved 22 May 2023.
- ^ van Gulik, Dirk-Willem (18 July 2023). "Save Open Source: The Impending Tragedy of the Cyber Resilience Act". Blog of the Apache Software Foundation. Retrieved 22 September 2023.
- ^ Phipps, Simon (24 January 2023). "What is the Cyber Resilience Act and why it's dangerous for Open Source". Voices of Open Source. Open Source Initiative. Retrieved 18 May 2023.
- ^ "Europe's cyber security strategy must be clear about open source | Computer Weekly". Computer Weekly. Retrieved 17 May 2023.
- ^ Stampelos, Tasos (30 July 2023). "Mozilla weighs in on the EU Cyber Resilience Act". Open Policy & Advocacy. Retrieved 30 July 2023.
- ^ a b Milinkovich, Mike (19 December 2023), "Good News on the Cyber Resilience Act", Life at Eclipse, retrieved 21 February 2024
- ^ The Eclipse Foundation Showcases Successful Open Source Industry Collaborations for 2023; Looks Ahead to Additional Growth in 2024, Eclipse Foundation Canada, 20 February 2024, retrieved 21 February 2024
External links[edit]
- "Cyber Resilience Act | Shaping Europe's digital future". digital-strategy.ec.europa.eu. 15 September 2022. Retrieved 17 May 2023.
- Proposal for a Regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements on EUR-Lex
- Procedure 2022/0272/COD on EUR-Lex
- Procedure 2022/0272(COD) on ŒIL
- ISO/IEC and European standards from CEN and CENELEC covering cybersecurity [1] on Genorma.com