The Cyber Resilience Act (CRA) raises the bar for manufacturers of products that include electronics. For CRA, cybersecurity suppliers need to support vulnerability management, regulatory reporting, long-term maintenance, and compliance documentation. These seven questions determine whether a supplier is prepared.
1. How Are Firmware and Software Updates Protected?
Are updates authenticated before installation? Does the supplier support secure boot, digital signatures, rollback protection, and secure recovery? Are signing keys properly generated, stored, and protected?
Solution: Use wolfBoot to provide secure boot by verifying firmware before execution using wolfCrypt and support authenticated firmware updates, digital signature verification, and rollback protection.
2. How Does the Supplier Respond to Vulnerabilities?
A supplier should have a documented security response and coordinated vulnerability disclosure process. Ask how vulnerabilities are communicated, whether CVEs are tracked, and how customers receive guidance and fixes.
wolfSSL maintains an active security response process, publishes security advisories, tracks affected versions and fixes, and provides direct access to engineers for security-related issues.
3. Can the Supplier Support CRA Reporting Requirements?
Manufacturers are responsible for meeting CRA reporting deadlines, but suppliers should be able to provide timely technical information. Ask who performs exploitability assessments, how customer impact is determined, and how quickly supporting information can be delivered.
wolfSSL works directly with customers to evaluate vulnerabilities, determine product impact, and provide the technical information needed to support CRA reporting obligations.
4. Is Software Transparency Available?
Request a Software Bill of Materials (SBOM) and ask whether it includes bundled cryptographic libraries and third-party dependencies. Understanding the software supply chain makes it easier to evaluate risk and respond to newly disclosed vulnerabilities.
wolfSSL supports software transparency through SBOMs and clearly documented software components, with lightweight libraries designed to minimize unnecessary dependencies.
5. What Is the Long-Term Support Plan?
Security maintenance should match the expected lifetime of the product. Ask how long updates are provided, what happens after the initial support period, and what migration options are available when products reach end of life.
wolfSSL provides commercial support and maintenance, including security updates, bug fixes, software updates, and technical assistance for long-term deployments.
6. What Compliance Evidence Is Provided?
Ask what documentation is available to support your compliance efforts. This may include secure configuration guidance, integration documentation, security certifications, and validation reports that can be incorporated into your technical file.
wolfCrypt provides independently validated cryptography, including FIPS 140-3 Certificates #4718 and #5041, along with documentation and integration support. wolfSSL also supports security-critical environments requiring standards such as DO-178C DAL A, ISO 26262, IEC 62443, and CNSA 2.0.
7. What Are the Commercial Responsibilities?
Understand what is included in the license and support agreement. Confirm which products and production volumes are covered and clarify the responsibilities that remain with the manufacturer versus those provided by the supplier.
wolfSSL provides commercial licensing, engineering services, consulting, support, and maintenance, allowing responsibilities for licensing, updates, security maintenance, and technical support to be clearly defined.
Final Thoughts
Selecting a cybersecurity supplier is no longer just about features or performance. The right partner should provide secure technology, long-term support, vulnerability response, and the documentation needed to help manufacturers meet CRA requirements throughout the product lifecycle.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now