EU Cyber Resilience Act

EU Cyber Resilience Act (CRA)

The European Union's Cyber Resilience Act (Regulation (EU) 2024/2847) introduces mandatory cybersecurity requirements for virtually all products with digital elements sold in the EU market, with full enforcement beginning December 11, 2027.

Honeywell is committed to ensuring that our products and those of our suppliers meet the requirements of the CRA.

This page outlines what the CRA requires and what Honeywell needs from you as a supplier.

What Is the Cyber Resilience Act?

The Cyber Resilience Act is the EU's first horizontal regulation establishing uniform cybersecurity requirements for hardware and software products placed on the European market. It aims to improve cybersecurity across the EU by imposing mandatory requirements on “products with digital elements”.

The CRA's reach is global. The regulation focuses not on where a product is manufactured but on whether it is made available on the EU market. Any manufacturer wishing to sell a product in the EU must comply, regardless of where it is headquartered or where production occurs.

Timeline

The CRA entered into force on December 10, 2024, and obligations come into effect in phases.

September 11, 2026: Vulnerability and incident reporting obligations begin. Manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA and their designated national CSIRT via ENISA's Single Reporting Platform.
December 11, 2027: Full application of all remaining requirements, including essential cybersecurity requirements, conformity assessment, CE marking, and technical documentation obligations.

Products placed on the market before December 11, 2027, become subject to the CRA's full requirements only if they undergo a substantial modification after that date, though reporting obligations apply regardless.

Supplier Obligations Under the CRA

If your products fall within the CRA's scope and are destined for placement on the EU market by Honeywell, you are responsible for the following

1. Secure by Design

Products must be designed, developed, and produced to ensure an appropriate level of cybersecurity based on a documented risk assessment.

No known exploitable vulnerabilities at the time of market placement
Secure-by-default configuration, with the ability for users to reset the product to its original state
Protection against unauthorized access through appropriate authentication and access control mechanisms
Confidentiality of stored and transmitted data, including encryption where appropriate
Integrity of data, commands, programs, and configuration against unauthorized manipulation
Data minimization, collecting and processing only data necessary for the product's intended purpose
Protection of availability, including resilience against denial-of-service attacks
Minimization of attack surfaces, including limitation of external interfaces to those necessary for the product's function
Security logging and monitoring capabilities
Ability to securely and permanently delete user data
Provision of security updates, including automatic updates enabled by default where applicable

Manufacturers must conduct a cybersecurity risk assessment that informs the implementation of these requirements across the product's planning, design, development, production, delivery, and maintenance phases.

2. Vulnerability Handling and Disclosure

Manufacturers must define a support period at the time of purchase. During the support period, the manufacturer must maintain SBOMs, identify vulnerabilities release patches free of charge.

Identify and document vulnerabilities and product components, including by generating a Software Bill of Materials (SBOM) in a commonly used, machine-readable format
Address and remediate vulnerabilities without delay, including by providing security updates free of charge
Apply effective and regular security testing and reviews
Publicly disclose information about fixed vulnerabilities
Establish and enforce a coordinated vulnerability disclosure policy
Provide a publicly accessible contact address for vulnerability reporting
Distribute security updates securely, accompanied by advisory messages

3. Documentation and Technical Files

Manufacturers must prepare technical documentation before placing a product on the market and retain it for 10 years after placement on the market or for the duration of the support period, whichever is longer.

4. Conformity Assessment and CE Marking

Manufacturers must supply an EU Declaration of Conformity (per Annex V of the CRA) and affix the CE marking to the product. From December 11, 2027, products without a CE marking demonstrating CRA conformity cannot be legally placed on the EU market.

Honeywell's Requirements for Suppliers

To maintain the integrity and compliance of products Honeywell places on the EU market, we are taking steps to ensure that our suppliers are on track to meet the requirements of the CRA.

CRA Compliance Attestation: A written declaration confirming that your products meet the essential cybersecurity requirements of Annex I, accompanied by a copy of your EU Declaration of Conformity and evidence of CE marking, or (before December 2027) a documented plan and timeline for achieving compliance.
Technical Documentation Access: Provision of relevant technical documentation, including cybersecurity risk assessments, security architecture descriptions, and test reports, sufficient for Honeywell to conduct due diligence on components integrated into its products.
Software Bill of Materials (SBOM): A machine-readable SBOM for each product or component supplied to Honeywell, covering at minimum all top-level dependencies and known vulnerabilities at the time of delivery.
Vulnerability Management Process Documentation: Evidence of an established vulnerability handling process, including your coordinated vulnerability disclosure policy, a designated contact point for vulnerability reports, and your defined support period (end-of-support date) for each product.
Incident Notification Commitment: Agreement to notify Honeywell promptly (and in no case later than 24 hours after becoming aware) of any actively exploited vulnerability or severe security incident affecting products or components supplied to Honeywell, in addition to any mandatory reporting to ENISA and national CSIRTs.
Ongoing Compliance Updates: Commitment to provide Honeywell with updates as the CRA's harmonised standards and implementing measures are finalized, including any changes to your product classifications or conformity assessment status.

Expect to receive communications from your Honeywell sourcing specialist to provide this information.

Timeline

Honeywell expects suppliers to progress toward full CRA readiness on the following schedule:

By September 11, 2026: Have vulnerability and incident reporting processes operational, including registration on the ENISA Single Reporting Platform, to meet the Article 14 reporting obligations that take effect on that date.
By Q4 2026: Provide Honeywell with CRA compliance attestations (or detailed compliance roadmaps) for all products and components supplied for integration into Honeywell products destined for the EU market.
By December 11, 2027: Achieve full CRA compliance, including completed conformity assessments, CE marking, EU Declarations of Conformity, and all required technical documentation.

Resources

Official CRA Legislation and EU Guidance

Standards and Frameworks

STAN4CRA.eu: Joint CEN/CENELEC/ETSI standards development portal for CRA harmonised standards
CEN-CENELEC M/606 Work Programme (PDF): Full list of 41 harmonised standards under development, with assigned committees and expected publication dates
ETSI CRA Draft Standards (Public Consultation): Access draft European Standards for comment
ENISA: CRA Requirements Standards Mapping: Maps existing international standards (including ETSI EN 303 645, IEC 62443, ISO/IEC 27002, ISO/IEC 30111, and ISO/IEC 29147) to specific CRA requirements
ENISA: CRA Implementation via EUCC: Analysis of how EU cybersecurity certification supports CRA conformity
European Vulnerability Database (EUVD): Centralized EU vulnerability information platform
NANDO Database (Notified Bodies): Locate designated conformity assessment bodies

Key Standards for Existing Compliance Alignment

If your organization already follows any of the frameworks below, you have a meaningful head start on CRA compliance. The ENISA standards mapping study identifies the following as having the strongest alignment with CRA requirements:

ETSI EN 303 645 (Cyber Security for Consumer IoT): Broadest coverage of Annex I, Part I product security requirements
IEC 62443 series (Industrial Automation and Control Systems Security): Strong coverage for industrial control systems and operational technology
ISO/IEC 27002 (Information Security Controls): Covers information security controls across multiple CRA requirements
ISO/IEC 30111 and ISO/IEC 29147 (Vulnerability Handling and Disclosure): Directly relevant to Annex I, Part II vulnerability handling obligations

Note that conformance with these existing standards supports but does not replace CRA-specific conformity assessment. The first CRA harmonised standards are expected from CEN/CENELEC and ETSI by Q3 2026. Products conforming to cited harmonised standards will benefit from a presumption of conformity with the CRA's essential requirements.

Contact

For general inquiries about Honeywell's cybersecurity requirements for suppliers, contact your Honeywell procurement representative. We encourage suppliers to begin their CRA readiness assessments now and to reach out with questions early in the process.

Balancing Data Center Computing Demands and Energy Efficiency

Data centers require a lot of energy. How can data centers use energy more efficiently? The answer may lie in integrating new systems and capabilities.
We Make Cool Things in Trieste, Italy: Fire Safety Solutions

Go behind the scenes in a plant that manufactures more than 4 million fire safety products each year.
We Make Cool Things in Trieste, Italy: Fire Safety Solutions

Go behind the scenes in a plant that manufactures more than 4 million fire safety products each year.

Supplier Information