If you already run an IEC 62443-4-1 secure development lifecycle, much of your CRA evidence exists — in a different shape. This crosswalk shows where each CRA obligation lands in 62443-4-1, so you can re-point that evidence rather than start again.
36CRA manufacturer obligations in the crosswalk
35relate to at least one 62443-4-1 requirement
17have no direct link — partial or supporting only
1with no 62443-4-1 coverage at all
CRA area
Total
Direct link
Partial or supporting only
No coverage
Annex I Part I
14
0
14
0
Annex I Part II
8
8
0
0
Article 13
9
7
2
0
Article 14
5
3
1
1
Basis: 87 links from 47 IEC 62443-4-1 requirements to 36 obligations in Regulation (EU) 2024/2847 — Annex I Parts I and II, Article 13 and Article 14. Crosswalk last reviewed 19 September 2026.
02
The gaps
Where 62443 alone won’t get you there
A mature 62443-4-1 programme covers a great deal of the CRA. It does not cover all of it, and where it does, it often proves you have a process rather than that the product has the property. Our crosswalk applies one rule throughout: a process obligation cannot discharge a product-property obligation.
No coverage · 1
Article 14(4): no 62443-4-1 requirement relates to it
Article 14(4) sets the reporting clock for severe incidents affecting the security of your product: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of that notification. No 62443-4-1 requirement in the crosswalk relates to it, and Article 14 reporting has applied since 11 September 2026. The evidence has to come from an incident-response and reporting process you build for the CRA.
Every Annex I Part I product property — and three process duties
All 14 Annex I Part I essential requirements relate to 62443-4-1 only partially or in a supporting role. 62443-4-1 is a process standard: it can show that you designed, tested and documented for secure-by-default, access control or attack-surface reduction — not that the product you ship has those properties. That takes product-level evidence.
This page tells you which 62443-4-1 requirements relate to each obligation. It cannot tell you whether your evidence would be accepted. That judgment — what an assessor would accept, and how to close the gaps 62443 alone doesn’t — is what the CRA Workbench does.
03
Lookup
Look up an obligation
Every obligation in the crosswalk, with its Official Journal text and the IEC 62443-4-1 requirements that relate to it. Select a row to open it. Filled chips are direct links, outlined chips are partial, dashed chips are supporting.
Showing all 36 obligations
EU Cyber Resilience Act obligations and the IEC 62443-4-1 requirement identifiers that relate to each
CRA reference
Obligation
IEC 62443-4-1
Coverage
Annex I Part I (1)Annex I Part I
Risk-based cybersecurity
SR-3SR-4SVV-1
Partial only
Regulation (EU) 2024/2847 · Annex I Part I (1) · Official Journal text
Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks
Related IEC 62443-4-1 requirements
SR-3Practice 2 · Specification of security requirementsSupportinghigh confidence
SR-4Practice 2 · Specification of security requirementsPartialmedium confidence
SVV-1Practice 5 · Security verification and validation testingPartialmedium confidence
Annex I Part I (2)(a)Annex I Part I
No known exploitable vulnerabilities
SM-7SI-1SI-2SVV-3SVV-4
Partial only
Regulation (EU) 2024/2847 · Annex I Part I (2)(a) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
be made available on the market without known exploitable vulnerabilities
SVV-3Practice 5 · Security verification and validation testingSupportinghigh confidence
SVV-4Practice 5 · Security verification and validation testingSupportinghigh confidence
Annex I Part I (2)(b)Annex I Part I
Secure by default configuration
SD-1SG-3
Supporting only
Regulation (EU) 2024/2847 · Annex I Part I (2)(b) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
be made available on the market with a secure by default configuration, unless otherwise agreed between manufacturer and business user in relation to a tailor-made product with digital elements, including the possibility to reset the product to its original state
Related IEC 62443-4-1 requirements
SD-1Practice 3 · Secure by designSupportinghigh confidence
Regulation (EU) 2024/2847 · Annex I Part I (2)(c) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
ensure that vulnerabilities can be addressed through security updates, including, where applicable, through automatic security updates that are installed within an appropriate timeframe enabled as a default setting, with a clear and easy-to-use opt-out mechanism, through the notification of available updates to users, and the option to temporarily postpone them
Regulation (EU) 2024/2847 · Annex I Part I (2)(d) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems, and report on possible unauthorised access
Related IEC 62443-4-1 requirements
SD-4Practice 3 · Secure by designPartialmedium confidence
Regulation (EU) 2024/2847 · Annex I Part I (2)(e) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms, and by using other technical means
Related IEC 62443-4-1 requirements
SD-4Practice 3 · Secure by designPartialmedium confidence
Annex I Part I (2)(f)Annex I Part I
Integrity of data, commands, configuration
SM-6SM-8SD-4
Partial only
Regulation (EU) 2024/2847 · Annex I Part I (2)(f) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands, programs and configuration against any manipulation or modification not authorised by the user, and report on corruptions
SD-4Practice 3 · Secure by designPartialmedium confidence
Annex I Part I (2)(g)Annex I Part I
Data minimisation
SD-4
Partial only
Regulation (EU) 2024/2847 · Annex I Part I (2)(g) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
process only data, personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of the product with digital elements (data minimisation)
Related IEC 62443-4-1 requirements
SD-4Practice 3 · Secure by designPartialmedium confidence
Annex I Part I (2)(h)Annex I Part I
Availability of essential functions
SD-2
Partial only
Regulation (EU) 2024/2847 · Annex I Part I (2)(h) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
protect the availability of essential and basic functions, also after an incident, including through resilience and mitigation measures against denial-of-service attacks
Related IEC 62443-4-1 requirements
SD-2Practice 3 · Secure by designPartialmedium confidence
Annex I Part I (2)(i)Annex I Part I
Minimise impact on other devices
SD-2SG-2
Partial only
Regulation (EU) 2024/2847 · Annex I Part I (2)(i) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
minimise the negative impact by the products themselves or connected devices on the availability of services provided by other devices or networks
Related IEC 62443-4-1 requirements
SD-2Practice 3 · Secure by designPartialmedium confidence
Regulation (EU) 2024/2847 · Annex I Part I (2)(j) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
be designed, developed and produced to limit attack surfaces, including external interfaces
Related IEC 62443-4-1 requirements
SD-1Practice 3 · Secure by designSupportinghigh confidence
Regulation (EU) 2024/2847 · Annex I Part I (2)(k) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
be designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques
Related IEC 62443-4-1 requirements
SD-2Practice 3 · Secure by designSupportinghigh confidence
SVV-2Practice 5 · Security verification and validation testingPartialmedium confidence
Annex I Part I (2)(l)Annex I Part I
Security-relevant recording and monitoring
SD-4
Partial only
Regulation (EU) 2024/2847 · Annex I Part I (2)(l) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
provide security related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt-out mechanism for the user
Related IEC 62443-4-1 requirements
SD-4Practice 3 · Secure by designPartialmedium confidence
Annex I Part I (2)(m)Annex I Part I
Secure data deletion and export
SD-4SG-4
Partial only
Regulation (EU) 2024/2847 · Annex I Part I (2)(m) · Official Journal text
Annex I Part I (2) opens: “On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where applicable, products with digital elements shall:”
provide the possibility for users to securely and easily remove on a permanent basis all data and settings and, where such data can be transferred to other products or systems, ensure that this is done in a secure manner
Related IEC 62443-4-1 requirements
SD-4Practice 3 · Secure by designPartialmedium confidence
Regulation (EU) 2024/2847 · Annex I Part II (1) · Official Journal text
Annex I Part II opens: “Manufacturers of products with digital elements shall:”
identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products
Regulation (EU) 2024/2847 · Annex I Part II (2) · Official Journal text
Annex I Part II opens: “Manufacturers of products with digital elements shall:”
in relation to the risks posed to products with digital elements, address and remediate vulnerabilities without delay, including by providing security updates; where technically feasible, new security updates shall be provided separately from functionality updates
Regulation (EU) 2024/2847 · Annex I Part II (3) · Official Journal text
Annex I Part II opens: “Manufacturers of products with digital elements shall:”
apply effective and regular tests and reviews of the security of the product with digital elements
Related IEC 62443-4-1 requirements
SVV-1Practice 5 · Security verification and validation testingDirecthigh confidence
SVV-2Practice 5 · Security verification and validation testingDirecthigh confidence
SVV-3Practice 5 · Security verification and validation testingDirecthigh confidence
SVV-4Practice 5 · Security verification and validation testingDirecthigh confidence
SVV-5Practice 5 · Security verification and validation testingPartialmedium confidence
DM-6Practice 6 · Management of security-related issuesPartialmedium confidence
Annex I Part II (4)Annex I Part II
Public disclosure of fixed vulnerabilities
DM-5SUM-2
Direct link
Regulation (EU) 2024/2847 · Annex I Part II (4) · Official Journal text
Annex I Part II opens: “Manufacturers of products with digital elements shall:”
once a security update has been made available, share and publicly disclose information about fixed vulnerabilities, including a description of the vulnerabilities, information allowing users to identify the product with digital elements affected, the impacts of the vulnerabilities, their severity and clear and accessible information helping users to remediate the vulnerabilities; in duly justified cases, where manufacturers consider the security risks of publication to outweigh the security benefits, they may delay making public information regarding a fixed vulnerability until after users have been given the possibility to apply the relevant patch
Related IEC 62443-4-1 requirements
DM-5Practice 6 · Management of security-related issuesDirecthigh confidence
Regulation (EU) 2024/2847 · Annex I Part II (5) · Official Journal text
Annex I Part II opens: “Manufacturers of products with digital elements shall:”
put in place and enforce a policy on coordinated vulnerability disclosure
Related IEC 62443-4-1 requirements
DM-1Practice 6 · Management of security-related issuesPartialmedium confidence
DM-5Practice 6 · Management of security-related issuesDirecthigh confidence
Annex I Part II (6)Annex I Part II
Contact address for vulnerability reports
DM-1
Direct link
Regulation (EU) 2024/2847 · Annex I Part II (6) · Official Journal text
Annex I Part II opens: “Manufacturers of products with digital elements shall:”
take measures to facilitate the sharing of information about potential vulnerabilities in their product with digital elements as well as in third-party components contained in that product, including by providing a contact address for the reporting of the vulnerabilities discovered in the product with digital elements
Related IEC 62443-4-1 requirements
DM-1Practice 6 · Management of security-related issuesDirecthigh confidence
Annex I Part II (7)Annex I Part II
Secure distribution of updates
SM-8SUM-4
Direct link
Regulation (EU) 2024/2847 · Annex I Part II (7) · Official Journal text
Annex I Part II opens: “Manufacturers of products with digital elements shall:”
provide for mechanisms to securely distribute updates for products with digital elements to ensure that vulnerabilities are fixed or mitigated in a timely manner and, where applicable for security updates, in an automatic manner
Patches disseminated without delay, free of charge
SUM-5
Direct link
Regulation (EU) 2024/2847 · Annex I Part II (8) · Official Journal text
Annex I Part II opens: “Manufacturers of products with digital elements shall:”
ensure that, where security updates are available to address identified security issues, they are disseminated without delay and, unless otherwise agreed between a manufacturer and a business user in relation to a tailor-made product with digital elements, free of charge, accompanied by advisory messages providing users with the relevant information, including on potential action to be taken
Ensure design, development, production per Annex I Part I
SM-1SM-2SM-3SM-4SM-5SR-3SD-1SI-1
Direct link
Regulation (EU) 2024/2847 · Article 13(1) · Official Journal text
When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I.
Regulation (EU) 2024/2847 · Article 13(2) · Official Journal text
For the purpose of complying with paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome of that assessment into account during the planning, design, development, production, delivery and maintenance phases of the product with digital elements with a view to minimising cybersecurity risks, preventing incidents and minimising their impact, including in relation to the health and safety of users.
Related IEC 62443-4-1 requirements
SR-1Practice 2 · Specification of security requirementsDirecthigh confidence
SR-2Practice 2 · Specification of security requirementsDirecthigh confidence
Article 13(3)Article 13
Risk assessment documented and kept updated
SM-12SM-13SR-2SR-5SD-3
Direct link
Regulation (EU) 2024/2847 · Article 13(3) · Official Journal text
The cybersecurity risk assessment shall be documented and updated as appropriate during a support period to be determined in accordance with paragraph 8 of this Article. That cybersecurity risk assessment shall comprise at least an analysis of cybersecurity risks based on the intended purpose and reasonably foreseeable use, as well as the conditions of use, of the product with digital elements, such as the operational environment or the assets to be protected, taking into account the length of time the product is expected to be in use. The cybersecurity risk assessment shall indicate whether and, if so in what manner, the security requirements set out in Part I, point (2), of Annex I are applicable to the relevant product with digital elements and how those requirements are implemented as informed by the cybersecurity risk assessment. It shall also indicate how the manufacturer is to apply Part I, point (1), of Annex I and the vulnerability handling requirements set out in Part II of Annex I.
SR-2Practice 2 · Specification of security requirementsDirecthigh confidence
SR-5Practice 2 · Specification of security requirementsPartialmedium confidence
SD-3Practice 3 · Secure by designPartialmedium confidence
Article 13(5)Article 13
Due diligence on integrated third-party components
SM-9SM-10SUM-3
Direct link
Regulation (EU) 2024/2847 · Article 13(5) · Official Journal text
For the purpose of complying with paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties so that those components do not compromise the cybersecurity of the product with digital elements, including when integrating components of free and open-source software that have not been made available on the market in the course of a commercial activity.
Regulation (EU) 2024/2847 · Article 13(6) · Official Journal text
Manufacturers shall, upon identifying a vulnerability in a component, including in an open source-component, which is integrated in the product with digital elements report the vulnerability to the person or entity manufacturing or maintaining the component, and address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Part II of Annex I. Where manufacturers have developed a software or hardware modification to address the vulnerability in that component, they shall share the relevant code or documentation with the person or entity manufacturing or maintaining the component, where appropriate in a machine-readable format.
Related IEC 62443-4-1 requirements
DM-5Practice 6 · Management of security-related issuesDirecthigh confidence
Article 13(8)Article 13
Vulnerability handling for the support period
SM-11DM-4
Direct link
Regulation (EU) 2024/2847 · Article 13(8) · Official Journal text
Manufacturers shall ensure, when placing a product with digital elements on the market, and for the support period, that vulnerabilities of that product, including its components, are handled effectively and in accordance with the essential cybersecurity requirements set out in Part II of Annex I. Manufacturers shall determine the support period so that it reflects the length of time during which the product is expected to be in use, taking into account, in particular, reasonable user expectations, the nature of the product, including its intended purpose, as well as relevant Union law determining the lifetime of products with digital elements. When determining the support period, manufacturers may also take into account the support periods of products with digital elements offering a similar functionality placed on the market by other manufacturers, the availability of the operating environment, the support periods of integrated components that provide core functions and are sourced from third parties as well as relevant guidance provided by the dedicated administrative cooperation group (ADCO) established pursuant to Article 52(15) and the Commission. The matters to be taken into account in order to determine the support period shall be considered in a manner that ensures proportionality. Without prejudice to the second subparagraph, the support period shall be at least five years. Where the product with digital elements is expected to be in use for less than five years, the support period shall correspond to the expected use time. Taking into account ADCO recommendations as referred to in Article 52(16), the Commission may adopt delegated acts in accordance with Article 61 to supplement this Regulation by specifying the minimum support period for specific product categories where the market surveillance data suggests inadequate support periods. Manufacturers shall include the information that was taken into account to determine the support period of a product with digital elements in the technical documentation as set out in Annex VII. Manufacturers shall have appropriate policies and procedures, including coordinated vulnerability disclosure policies, referred to in Part II, point (5), of Annex I to process and remediate potential vulnerabilities in the product with digital elements reported from internal or external sources.
DM-4Practice 6 · Management of security-related issuesDirecthigh confidence
Article 13(12)Article 13
Technical documentation drawn up before placing on market
SR-4SG-7
Partial only
Regulation (EU) 2024/2847 · Article 13(12) · Official Journal text
Before placing a product with digital elements on the market, manufacturers shall draw up the technical documentation referred to in Article 31. They shall carry out the chosen conformity assessment procedures as referred to in Article 32 or have them carried out. Where compliance of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I and of the processes put in place by the manufacturer with the essential cybersecurity requirements set out in Part II of Annex I has been demonstrated by that conformity assessment procedure, manufacturers shall draw up the EU declaration of conformity in accordance with Article 28 and affix the CE marking in accordance with Article 30.
Related IEC 62443-4-1 requirements
SR-4Practice 2 · Specification of security requirementsPartialmedium confidence
Instructions and information to the user (Annex II)
SUM-2SG-1SG-2SG-3SG-4SG-5SG-6SG-7
Direct link
Regulation (EU) 2024/2847 · Article 13(18) · Official Journal text
Manufacturers shall ensure that products with digital elements are accompanied by the information and instructions to the user set out in Annex II, in paper or electronic form. Such information and instructions shall be provided in a language which can be easily understood by users and market surveillance authorities. They shall be clear, understandable, intelligible and legible. They shall allow for the secure installation, operation and use of products with digital elements. Manufacturers shall keep the information and instructions to the user set out in Annex II at the disposal of users and market surveillance authorities for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer. Where such information and instructions are provided online, manufacturers shall ensure that they are accessible, user-friendly and available online for at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer.
Regulation (EU) 2024/2847 · Article 13(19) · Official Journal text
Manufacturers shall ensure that the end date of the support period referred to in paragraph 8, including at least the month and the year, is clearly and understandably specified at the time of purchase in an easily accessible manner and, where applicable, on the product with digital elements, its packaging or by digital means. Where technically feasible in light of the nature of the product with digital elements, manufacturers shall display a notification to users informing them that their product with digital elements has reached the end of its support period.
Notify actively exploited vulnerabilities to the CSIRT and ENISA
DM-3
Direct link
Regulation (EU) 2024/2847 · Article 14(1) · Official Journal text
A manufacturer shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that actively exploited vulnerability via the single reporting platform established pursuant to Article 16.
Related IEC 62443-4-1 requirements
DM-3Practice 6 · Management of security-related issuesDirecthigh confidence
Article 14(2)Article 14
Vulnerability reporting: 24 h early warning, 72 h notification, 14-day final report
DM-5
Direct link
Regulation (EU) 2024/2847 · Article 14(2) · Official Journal text
For the purposes of the notification referred to in paragraph 1, the manufacturer shall submit: (a) an early warning notification of an actively exploited vulnerability, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, indicating, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available; (b) unless the relevant information has already been provided, a vulnerability notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability, which shall provide general information, as available, about the product with digital elements concerned, the general nature of the exploit and of the vulnerability concerned as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be; (c) unless the relevant information has already been provided, a final report, no later than 14 days after a corrective or mitigating measure is available, including at least the following: (i) a description of the vulnerability, including its severity and impact; (ii) where available, information concerning any malicious actor that has exploited or that is exploiting the vulnerability; (iii) details about the security update or other corrective measures that have been made available to remedy the vulnerability.
Related IEC 62443-4-1 requirements
DM-5Practice 6 · Management of security-related issuesDirecthigh confidence
Article 14(3)Article 14
Notify severe incidents to the CSIRT and ENISA
DM-5
Supporting only
Regulation (EU) 2024/2847 · Article 14(3) · Official Journal text
A manufacturer shall notify any severe incident having an impact on the security of the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA. The manufacturer shall notify that incident via the single reporting platform established pursuant to Article 16.
Related IEC 62443-4-1 requirements
DM-5Practice 6 · Management of security-related issuesSupportinghigh confidence
Article 14(4)Article 14
Incident reporting: 24 h early warning, 72 h notification, one-month final report
None mapped
No coverage
Regulation (EU) 2024/2847 · Article 14(4) · Official Journal text
For the purposes of the notification referred to in paragraph 3, the manufacturer shall submit: (a) an early warning notification of a severe incident having an impact on the security of the product with digital elements, without undue delay and in any event within 24 hours of the manufacturer becoming aware of it, including at least whether the incident is suspected of being caused by unlawful or malicious acts, which shall also indicate, where applicable, the Member States on the territory of which the manufacturer is aware that their product with digital elements has been made available; (b) unless the relevant information has already been provided, an incident notification, without undue delay and in any event within 72 hours of the manufacturer becoming aware of the incident, which shall provide general information, where available, about the nature of the incident, an initial assessment of the incident, as well as any corrective or mitigating measures taken, and corrective or mitigating measures that users can take, and which shall also indicate, where applicable, how sensitive the manufacturer considers the notified information to be; (c) unless the relevant information has already been provided, a final report, within one month after the submission of the incident notification under point (b), including at least the following: (i) a detailed description of the incident, including its severity and impact; (ii) the type of threat or root cause that is likely to have triggered the incident; (iii) applied and ongoing mitigation measures.
Related IEC 62443-4-1 requirements
None. No IEC 62443-4-1 requirement in the crosswalk relates to this obligation. Evidence has to come from somewhere else — see where 62443 alone won’t get you there.
Article 14(8)Article 14
Inform users of the vulnerability or incident
DM-5
Direct link
Regulation (EU) 2024/2847 · Article 14(8) · Official Journal text
After becoming aware of an actively exploited vulnerability or a severe incident having an impact on the security of the product with digital elements, the manufacturer shall inform the impacted users of the product with digital elements, and where appropriate all users, of that vulnerability or incident and, where necessary, of any risk mitigation and corrective measures that the users can deploy to mitigate the impact of that vulnerability or incident, where appropriate in a structured, machine-readable format that is easily automatically processable. Where the manufacturer fails to inform the users of the product with digital elements in a timely manner, the notified CSIRTs designated as coordinators may provide such information to the users when considered to be proportionate and necessary for preventing or mitigating the impact of that vulnerability or incident.
Related IEC 62443-4-1 requirements
DM-5Practice 6 · Management of security-related issuesDirecthigh confidence
No obligations match those filters.
04
Method
How to read the mapping
Every link is typed. The relation is always intersects-with — the OSCAL relation for two requirements that overlap without either containing the other. What varies is how close the link is, and how sure we are of it.
DirectThe 62443-4-1 requirement’s process and records are the main evidence for this obligation.
PartialIt covers part of the obligation. Something else has to supply the rest.
SupportingIt supports the obligation but does not constitute it — typically a process that evidences a product property.
ConfidenceHow sure the determination is: high, medium or low. Strength and confidence are separate: a link can be confidently supporting.
IEC 62443-4-1 organises its requirements into eight practices. The requirement identifiers carry the practice prefix:
SM Practice 1 · Security management
SR Practice 2 · Specification of security requirements
SD Practice 3 · Secure by design
SI Practice 4 · Secure implementation
SVV Practice 5 · Security verification and validation testing
DM Practice 6 · Management of security-related issues
SUM Practice 7 · Security update management
SG Practice 8 · Security guidelines
This page shows 62443-4-1 requirement identifiers only. IEC 62443-4-1 is a copyrighted IEC standard; to read what each requirement says, use your licensed copy. The CRA text is reproduced from the Official Journal. The crosswalk covers the manufacturer obligations of Annex I and Articles 13 and 14 that a secure development lifecycle is expected to evidence; it does not model every paragraph of the Regulation.
Sources: Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 (Cyber Resilience Act), Official Journal of the European Union, OJ L, 2024/2847, 20.11.2024 — EUR-Lex. IEC 62443-4-1:2018 (requirement identifiers only; the standard itself is available from IEC).
05
Download
Download the crosswalk as a CSV
Take the full mapping into your own gap register: one row per link, with the CRA reference, the Official Journal text, the 62443-4-1 identifier, its practice, relation, strength and confidence.
Your download has started.
If it didn’t, use the button below. Your details are on their way to our team at Malkan Solutions.
A download of this mapping: CRA references and Official Journal text, with IEC 62443-4-1 requirement identifiers only — no IEC text. Your name, email and company go to Malkan Solutions; see our privacy notice.
From the crosswalk to evidence an assessor accepts.
The CRA Workbench takes your 62443-4-1 records, maps them onto the CRA, and tells you in an assessor’s terms what they prove, what they don’t, and what to add — then assembles a reviewer-ready Annex VII package.
This crosswalk is general information about Regulation (EU) 2024/2847, not legal advice. Figures and dates are verified against primary sources, but the CRA’s harmonised-standards landscape is still settling — confirm against the current official text before relying on any point. The mapping to IEC 62443-4-1 is our own analysis, not an official or harmonised correspondence, and using 62443-4-1 does not confer a presumption of conformity with the CRA. The CRA Workbench is software that produces draft documentation for expert review; it indicates the evidence needed and does not, by itself, guarantee compliance.
