Effectively Embedding Product Security: Requirements of the Cyber Resilience Act

Digital products must be operated securely and updated over the course of many years. The Cyber Resilience Act (CRA), an EU regulation establishing mandatory cybersecurity requirements for products with digital elements, tightens regulatory obligations in this regard, from development through to operation. In this context, product security refers to the cybersecurity of these products throughout their entire lifecycle and thus differs from the security of internal information technology (IT) systems.

The key is a two-pronged approach: operational implementation in product development and centralized governance for standards, responsibilities, and consistent implementation. The white paper “Product Security under the Cyber Resilience Act” explores this interplay in greater depth.

Product security accompanies a product throughout its entire lifecycle.

This includes 

• secure architectural and design decisions, 
• implementation, 
• testing, structured vulnerability management,  
• regular security updates, 
• and the handling of security incidents.

This responsibility requires close integration with product development, as security-related decisions are made at the very point where technical directions are set.

Furthermore, regulatory reporting requirements, uniform standards, and consistent processes demand cross-functional coordination. Product Security thus operates at the intersection of operational implementation within development teams and centralized governance at the corporate level. 

In practice, various organizational models have become established. Embedding product security within research and development enables the early integration of security considerations into the product development process. Models centered around the Chief Information Security Officer (CISO) organization place greater emphasis on governance and compliance. Both approaches offer advantages but each has its limitations—such as operational distance from development or a lack of consistency across product lines.

Consequently, a hybrid organizational model is increasingly gaining traction. A central role, such as the Corporate Product Security Officer (CPSO), is responsible for governance, standards, and reporting, while product security roles within the development departments ensure operational implementation. This approach combines technical effectiveness with regulatory oversight.