What happened?
The reporting obligation under the EU Cyber Resilience Act (CRA) has come into force. Against this backdrop, Genetec, a provider of physical security software, has published a guide designed to help security managers assess the cybersecurity competence of technology vendors. The guide formulates five key questions that organizations can use to evaluate how vendors develop, maintain, and support connected products throughout their entire lifecycle.
The Details
The CRA sets out cybersecurity requirements for products with digital elements sold within the European Union. At its core are secure product development, effective vulnerability management, transparency in cybersecurity, and continuous product support throughout the entire lifecycle. While the regulation primarily targets manufacturers, it also affects companies that distribute, install, procure, and operate connected devices—including operators of alarm systems, video surveillance, or access control systems.
Genetec recommends that security managers ask potential technology vendors the following five questions:
- How long will the product receive security updates and support? The CRA obliges manufacturers to provide security updates throughout a defined support period, which generally must span at least five years or the expected lifespan of the product, whichever is shorter.
- Was cybersecurity integrated from the outset? The principles of "Secure by Design" and "Secure by Default" are central to the CRA. Vendors should be able to explain how cybersecurity has been incorporated into design, development, testing, and the entire product lifecycle.
- How does the vendor identify, communicate, and remediate security vulnerabilities? This includes regular security testing, a coordinated vulnerability disclosure process, prompt and risk-based remediation, secure delivery of updates, and clear information about resolved vulnerabilities.
- Is the vendor transparent about its own cybersecurity practices? Responsible vendors communicate how they develop, test, and maintain products, and provide customers and system integrators with clear guidelines for secure deployment.
- How does the vendor support long-term cyber resilience? This includes how the support period is defined and communicated, how vulnerabilities are handled, how updates are delivered, and how the product's end-of-life is managed.
Mathieu Chevalier, Principal Security Architect at Genetec Inc., puts the development into perspective: "The Cyber Resilience Act reinforces many of the 'Secure by Design' and lifecycle management principles that Genetec has championed for years. The CRA regulations raise the bar for product security and transparency, giving buyers a clear foundation for evaluating technology vendors while optimizing their cyber resilience in the long term."
Context
For the physical security technology industry—spanning video surveillance, access control, and connected alarm systems—the CRA represents a significant shift. Devices that were once evaluated primarily on mechanical or structural security aspects, such as deposit safes or padlock hasps, are now increasingly networked and thus exposed to potential cyber risks. Anyone who procures, installs, or operates connected technology will in future share responsibility for ensuring these systems comply with CRA requirements. The regulation thus shifts the focus from a one-time purchasing decision toward an ongoing partnership between vendor and operator.
Practical Tips
- Before procurement, clarify how long the manufacturer guarantees security updates—per the CRA, the benchmark is at least five years or the expected service life.
- Ask whether "Secure by Design" and "Secure by Default" were already factored in during the development phase.
- Review the vendor's vulnerability management procedures, particularly the processes for disclosing and remediating security flaws.
- Demand transparency: Does the vendor document its own security practices and provide guidance on system hardening?
- Inquire early about end-of-life strategies for products, including connected components such as a wardhub within security systems.
Outlook
With the CRA reporting obligation now in force, cybersecurity is becoming a fixed evaluation criterion when selecting physical security technology. Companies operating connected security solutions should use the five questions outlined above as a basis for vendor discussions and adapt their procurement processes accordingly. In the long term, according to Chevalier, an approach is likely to prevail in which cybersecurity is understood not as a one-time decision but as an ongoing partnership between manufacturers, system integrators, and operators.
