Search for...

Thе Cyber ​​Resilience Act: What Startups Should Know About Hardware and Software Transparency in 2024

Thе Cyber ​​Resilience Act: What Startups Should Know About Hardware and Software Transparency in 2024, TheRecursive.com
Image credit: Diana Nitescu, CEO & Founder of OctogonHub
https://therecursive.com/author/diana-nitescu/

Diana is the Founder and CEO of OctogonHUB, space for start-ups in deeptech, science, research. With a background of 22 years in corporate business, Diana assumed the mission of mentoring start-ups and IT&C companies in the area of ​​CyberSecurity Policy. Since 2023, she has been certified as Auditor and NIS Manager by the Romanian Cybersecurity Directorate.
, ~

Are you a start-up or IT&C company? Are you ready to apply for the EU Cyber ​​Security Certificate? Do you know that without this Certificate you will not be able to sell an ICT product in the EU? … in the near future

If until 2023 the Cyber ​​Security regulations targeted only key companies (corporations and companies with a large socio-economic NIS impact), starting from 2024 according to the Cyber ​​Resilience Act we expect the regulation of the entire IT&C market (manufacturers, importers, and distributors of hardware and software).

The EU establishes uniform cyber security standards and imposes the obligation to obtain accreditation, which gives the right to sell hardware and software products connected directly or indirectly to the Internet.

The purpose of this initiative is to protect EU users from security flaws in the production and maintenance stage of software and hardware products.

For your company to be considered resilient from a Cyber ​​perspective, we advise you to implement a Cyber ​​Security Policy, that aims at strategies, procedures, techniques, and clear tools for evaluation, monitoring, and testing throughout the life of the product: concept, production, testing, implementation, commercialization, use, update, maintenance, uninstallation/termination.

Stage 1 | Concept

How do you design your product?

This is the moment when we recommend you to build your Cyber ​​Security Policy taking into account every stage of development and technical detail of the product.

This Policy will be communicated and applied by all members of the development team and it will also be the one that will help you obtain the CE cyber accreditation for your product.

Stage 2 | Product development

How do you ensure and verify security and latest updates for:
1. a work device on which the code is generated
2. the applications used and their licenses
3. the development of code resistant to injections SQL, XSS, CSRF, etc.. See also Top OWASP
4. the servers where the code is stored
5. code integration with other algorithms and industry tools. Third-party policy and OSINT
6. code share techniques and platforms used between members of the development team
7. devices, tools, and the in-house scanning and testing team. Opt for RPA.
8. the behavior and ethics of the employees from the development and testing team. See also the current SecDevOps approach
9. installing/uninstalling the code on your hardware product
10. IP policy

Read more:  BSides Conference in Sofia Will Gather Cybersecurity Professionals and Aficionados

Stage 3 | Testing the product on the market

Where does your product run? What are the vulnerabilities specific to the runtime environment? What cyber measures do you implement?

If you are a B2B, the market for you is the client’s intranet and the internet.
If you are a B2C or deliver for a B2C, the market is the internet and the devices of individual customers.

Stage 4 | Installation and use of the product at the customer

Are you technically, legally, and cyber-prepared to sell the product on the market?

Most start-ups are only now becoming aware and addressing cyber security issues under the pressure of some client demands.

This is also the moment when, within a maximum of 36 months from the entry into force of the Cyber ​​Resilience Act, your company will have to accredit its product from a cyber point of view and receive the CE digital mark, for the right to market the product within the European space.
If you built your Cyber ​​Security Policy at Stage 1, now you will use that documentation to obtain the CE cyber accreditation.

Stage 5 | Update & maintenance & upgrade

Is the update as cyber-resilient as the product? Are you prepared for maintenance in case of a cyber incident? Is your product compatible with new technologies?

We recommend that you include clear procedures for updating, maintaining, upgrading, and resolving security incidents within your Cyber Policy.

Given the development of new technologies (IoT, AI, blockchain, quantum computing, metaverse) and devices, don’t forget that something could go wrong on the cyber side of your product.

That’s why it is important to prepare in advance a procedure for incident alerts and ad-hoc maintenance and stay up to date with the technologies that will follow.

Stage 6 | Uninstallation & termination

How do you ensure your internal and your product’s security after the termination of the contract? What security guarantees do you offer the client after your legal collaboration has ended?

We recommend that you have the following chapter in the contract with your clients “Uninstallation policy and cyber security” through which you can receive and provide security guarantees for at least 1-2 years after the termination of the contract.

Read more:  Bilyana Lilly on How the War in Ukraine Will Affect Cybersecurity in 2023

Probably, having read the article up to this point, you have already realized how important a Cyber ​​Security Policy is, even if you have a start-up in the early stages (pre-seed or seed).

What happens if we do NOT have the CE accreditation?

1. we are legally vulnerable to cyber incidents (product, company, and distribution chain)
2. we lose customers
3. we receive fines
4. the product may be banned on the EU market
5. we cannot participate in auctions
6. we are not eligible for investors
7. the too late implementation of cyber procedures could be more expensive in terms of time, money, and human effort, and the final result may only be satisfactory.

So we can conclude that without an adequate Cyber ​​Security Policy implemented on time, our work and financial and human investment can be dynamited exactly at a moment when our business is preparing to scale.

What can we do if we already have a product for which we have not applied any Cyber ​​Policy so far?

Regarding this case, which is very frequent, we will come back in a future article.

Help us grow the emerging innovation hubs in Central and Eastern Europe

Every single contribution of yours helps us guarantee our independence and sustainable future. With your financial support, we can keep on providing constructive reporting on the developments in the region, give even more global visibility to our ecosystem, and educate the next generation of innovation journalists and content creators.

Find out more about how your donation could help us shape the story of the CEE entrepreneurial ecosystem!

One-time donation

You can also support The Recursive’s mission with a pick-any-amount, one-time donation. 👍