Network Equipment Under the CRA
Routers, switches, and firewalls face some of the strictest CRA requirements. Network equipment is the backbone of connectivity — a vulnerability here affects every device behind it.
Classification
| Equipment | CRA Class | Standard |
|---|---|---|
| Consumer routers/modems | Important Class I | EN 304 627 |
| Physical/virtual network interfaces | Important Class I | EN 304 625 |
| Firewalls, IDS/IPS | Important Class II | EN 304 636 |
| Telecom network functions | Critical | EN 304 642 |
Key Requirements for EN 304 627 (Routers/Switches)
Authentication and Access Control
- No default credentials — unique per-device or user-set on first boot
- Strong password requirements — minimum complexity enforcement
- Encrypted management interfaces — HTTPS/SSH only, no telnet/HTTP
- Failed login protection — account lockout or progressive delays
Firmware Security
✅ Signed firmware updates (cryptographic verification)
✅ Secure boot chain (prevent unauthorized firmware)
✅ Rollback protection (prevent downgrade attacks)
✅ Automated update notification (inform users of available patches)
✅ OTA update capability (remote patching without physical access)Network Security
- Default firewall rules — deny inbound by default
- No unnecessary services — UPnP, WPS disabled by default
- DNS-over-HTTPS/TLS — encrypted DNS as default
- Network segmentation — VLAN/guest network support
Data Protection
- Encrypted storage — credentials, certificates, and configuration
- Factory reset — complete data wipe capability
- Minimal data collection — collect only what’s needed for operation
For Firewall/IDS Manufacturers (Class II)
EN 304 636 adds requirements:
- Detection efficacy testing — documented detection rates for known attacks
- Rule update mechanism — secure, signed, and verified
- Logging integrity — tamper-evident security logs
- High availability — security device failure must not create security gaps
The Telecom Challenge (Critical Products)
Network functions for telecom (EN 304 642) face the highest bar:
- Mandatory EU-type examination (third-party certification)
- Continuous monitoring and assessment
- Coordinated with existing telecom regulations (EECC)
Practical Checklist
For router/switch manufacturers:
- Eliminate all default passwords
- Implement signed firmware updates
- Enable HTTPS-only management interface
- Generate SBOM for all firmware components
- Disable unnecessary services by default
- Document security update support period (min 5 years)
- Establish vulnerability disclosure process
- Prepare technical documentation for conformity assessment
Manufacturing network equipment for the EU market? I help organizations prepare for CRA compliance. Get in touch.