Cyber Resilience Act Support
The EU Cyber Resilience Act (CRA) sets cybersecurity requirements for products with digital elements sold in the European Union. If you build devices on GoAhead, Appweb or Ioto, our software is a component of your product. EmbedThis supports you in meeting your CRA obligations for that component.
Key Dates
| Date | Milestone |
|---|---|
| 11 September 2026 | Manufacturers must report actively exploited vulnerabilities and severe incidents |
| 11 December 2027 | All other CRA obligations apply |
What EmbedThis Provides
| Your obligation | How EmbedThis supports it |
|---|---|
| Exercise due diligence when integrating third-party components (Article 13) | A documented security engineering program and a published security policy for each server |
| Handle vulnerabilities effectively for the support period (Annex I, Part II) | Coordinated vulnerability handling with a single security contact, security@embedthis.com |
| Test and review the product's security regularly | Continuous auditing, fuzzing and sanitizer testing of GoAhead, Appweb and Ioto |
| Address vulnerabilities without delay through security updates | Security fixes released through the Builder |
| Distribute updates securely and inform users | Security advisories and release notes in the Builder, with notification before public disclosure |
| Report actively exploited vulnerabilities within 24 hours (Article 14) | Early advisory notification through the Builder, so you learn of issues in our software promptly |
| Report vulnerabilities found in third-party components to their maintainer (Article 13) | A clear reporting route, response and coordinated fix process. See our security policy |
| Determine and publish a support period | Releases and supported versions published in the Builder |
We provide CRA release documentation with GoAhead and Appweb releases, drawing on the evidence from our security engineering program. Ioto CRA documentation is in preparation.
What Remains Your Responsibility
The CRA places obligations on the manufacturer of the final product. EmbedThis supports these, but cannot meet them for you:
- The cybersecurity risk assessment for your product.
- Conformity assessment, the EU declaration of conformity and CE marking.
- Technical documentation for your product, including its software bill of materials.
- Reporting actively exploited vulnerabilities and severe incidents in your product to your CSIRT and ENISA.
- Delivering security updates to your customers' devices for your product's support period.
- Securing the code you build on our servers, your configuration, and the platform beneath them.
Stay Current
Subscribe to security notifications in the Builder to receive advisories and remediation information before public disclosure. Keep your devices on supported releases.
Contact
Report a vulnerability to security@embedthis.com. For CRA questions about your product, talk to us.