The European Telecommunications Standards Institute (ETSI) has taken a significant step towards ensuring the cybersecurity of products sold in the European Union (EU) by proposing 17 comprehensive standards. These standards are designed to align with the EU Cyber Resilience Act (CRA), which will come into full effect by December 2027. The proposed standards cover a wide range of product categories, from network and edge devices to security solutions and IoT appliances, ensuring a holistic approach to cybersecurity. This move by ETSI is a crucial development in the global effort to enhance cybersecurity standards and protect consumers and businesses from potential threats. The standards mandate modern cryptography, secure-by-default settings, and the implementation of a software bill of materials (SBOM), which is a machine-readable inventory of software dependencies. These measures are essential to ensure that products sold in the EU meet the highest security standards and can withstand evolving cyber threats. The proposed standards have been submitted to 41 member organizations across Europe, including national standardization bodies and industry organizations, and are currently under public inquiry. This public engagement phase allows stakeholders to provide feedback and ensure that the standards are comprehensive and effective. The final versions of these standards are expected to be available by December 2026, providing ample time for manufacturers, importers, distributors, service providers, and developers to comply. This proactive approach by ETSI and the other EU-approved standardization bodies, the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC), is a testament to their commitment to cybersecurity. They have organized workshops to assist small and medium businesses in complying with the CRA, ensuring that the standards are accessible and practical for all stakeholders. The CRA's impact extends beyond the EU, as it sets a global benchmark for cybersecurity standards. Two-thirds of the open-source community, according to a recent report, is unaware of the CRA, highlighting the need for widespread education and awareness. As the world becomes increasingly interconnected, these standards will play a pivotal role in safeguarding digital ecosystems and ensuring the resilience of critical infrastructure. In conclusion, ETSI's proposal of 17 cybersecurity standards is a significant step towards a safer digital future. These standards not only align with the EU's CRA but also set a global standard for cybersecurity. As the public inquiry period progresses, stakeholders should actively participate to ensure that these standards are robust, inclusive, and effective in addressing the ever-evolving landscape of cyber threats.
