Hardware lasts while its dependencies keep changing
An industrial gateway can remain in service while its libraries, operating system and maintenance tools change repeatedly. An update may need testing on several hardware revisions before installation at remote sites. Preparation starts by identifying affected devices, dependencies and validation constraints.
Complexity increases when inventories come from several suppliers. A single commercial version may cover different firmware builds and components with different support deadlines. Reconstructing these links under pressure leaves little time to compare fixes, upgrades and replacements.
Determine which products fall within CRA scope
The CRA covers products with digital elements according to criteria including market availability and intended or reasonably foreseeable logical or physical connection. Assess each product and the manufacturer’s role. Check exclusions and sector-specific rules, especially for medical devices, vehicles and equipment covered by specific frameworks.
For manufacturers in scope, the Commission connects design, assessment, support information and post-market vulnerability handling. The CRA’s main obligations apply from 11 December 2027; some obligations, including manufacturer reporting, already apply. Ongoing vulnerability management supplies evidence for these processes under the manufacturer’s responsibility.
Sources: CRA, Regulation (EU) 2024/2847, Articles 2, 13, 69, 71 and Annex I, European Commission: manufacturer obligations before and after market placement, European Commission: Cyber Resilience Act and application timetable
Fictional case: a gateway in three revisions
In this fictional example, Boréal maintains gateway revisions A, B and C. A uses firmware 1.9 and an older networking dependency; B uses firmware 2.4; C uses another platform. Advisory DEMO-INDUSTRIE-01 concerns a dependency function in A and B. C must be assessed separately.
For A, the supplier must confirm whether a fix is possible. For B, a fix exists but awaits device validation. For C, assessment remains open pending the detailed inventory. The review separates these three situations and assigns each next step to an owner.
| Fictional revision | Situation | Next evidence required |
|---|---|---|
| A / firmware 1.9 | Supplier solution to confirm | Sourced response and maintenance plan |
| B / firmware 2.4 | Fix awaiting validation | Test report, then installed version |
| C / other platform | Insufficient information | Inventory and affected-function analysis |
Connect variants, dependencies and support
Associate product reference, hardware revision, firmware, components and deployed devices. Retain the supplier source and coverage conditions for each support deadline. If a date or coverage detail is missing, request confirmation before using it as a budget assumption.
Several devices can share an assessment if the examined conditions are identical. Variants and sites remain identifiable, and a new revision triggers reassessment of that grouping. Link access, testing and rollback constraints to actions so the review can distinguish missing supplier information from validation or deployment blockers.
Prepare maintenance campaigns and budget decisions
Bring together fixes, planned renewals and confirmed support deadlines. Compare compatible updates, branch changes, replacements and temporary measures. Grouping work can simplify an intervention; deferring necessary treatment still requires an explicit decision. Retain the reasons for dependencies between actions in the schedule.
CyberLifeCycle monitors and maintains case files for the variants in your scope. Get visibility of outstanding supplier responses, campaigns awaiting validation and deadlines for maintenance budgeting. Product decisions, testing and deployment remain with the manufacturer and relevant teams.
Sources consulted
- CRA, Regulation (EU) 2024/2847, Articles 2, 13, 69, 71 and Annex IAccessed on 30 October 2026.
- European Commission: Cyber Resilience Act and application timetableAccessed on 30 October 2026.
- European Commission: manufacturer obligations before and after market placementAccessed on 30 October 2026.