EU CRA and Cryptography: Meeting Cyber Resilience Act Security Requirements with a CBOM
The Cyber Resilience Act expects products to protect data with appropriate, up-to-date cryptography. A cryptographic bill of materials is how you prove what you use and find what is weak.
- Annex I of the CRA expects confidentiality and integrity protection using state-of-the-art mechanisms, which in practice means sound, current cryptography.
- You cannot secure cryptography you cannot see; a CBOM inventories algorithms, keys, certificates and protocols across a product.
- A CBOM surfaces weak or deprecated primitives (for example MD5, SHA-1, small RSA keys) that would undermine CRA security claims.
- It also feeds vulnerability handling when a cryptographic library has a CVE.
What the CRA says about cryptography
The Cyber Resilience Act, Regulation (EU) 2024/2847, requires products with digital elements to be designed and built to ensure an appropriate level of cybersecurity [1]. Annex I calls for protecting the confidentiality and integrity of data, including through encryption or other technical means, and for processing only the data that is necessary. In other words, a manufacturer has to be able to say which cryptography protects its product, and show that it is sound and current.
Why a CBOM
A cryptographic bill of materials (CBOM) is a machine-readable inventory of the algorithms, keys, certificates and protocols a product uses, with where each is used. CycloneDX added cryptographic asset support precisely for this [2]. Where an SBOM answers what software is in here, a CBOM answers how is it protected, which is what the CRA's data-protection requirements turn on.
Finding what would fail a CRA review
Cryptography ages. Primitives that were fine a decade ago, MD5 and SHA-1 for integrity, RSA-1024 for signatures, are now weak. A CBOM makes these visible so you can remediate before they undermine a security claim or an incident investigation:
| CBOM finding | CRA relevance |
|---|---|
| Deprecated hash (MD5, SHA-1) | Integrity protection no longer state of the art |
| Weak key sizes (RSA-1024) | Confidentiality at risk; remediate before market placement |
| Expiring or expired certificates | Operational and trust failures during the support period |
| Vulnerable crypto library | Feeds CRA vulnerability handling and updates |
Cryptography and the support period
The CRA expects security to hold across a defined support period. Certificates expire and algorithms are deprecated inside that window, so a CBOM is not a one-off: it is monitored, like the post-quantum transition, so you can plan renewals and migrations rather than react to failures.
How IntelliXBOM helps
IntelliXBOM generates CBOMs during scanning, scores each cryptographic asset for strength and quantum readiness, flags deprecated primitives and expiring certificates, and correlates crypto libraries with known CVEs. See finding weak cryptography with a CBOM. The platform provides evidence; the manufacturer remains responsible for CRA conformity.
Frequently asked questions
Does the CRA mandate specific cryptographic algorithms?
No. It requires an appropriate, state-of-the-art level of protection rather than a fixed algorithm list. A CBOM lets you demonstrate that your cryptography is current and free of deprecated primitives.
How is a CBOM different from an SBOM?
An SBOM lists software components; a CBOM lists cryptographic assets, algorithms, keys, certificates and protocols, and where they are used. They are complementary and often generated from the same scan.
Where does the cryptography requirement sit in the CRA?
In the essential requirements of Annex I, which cover protecting the confidentiality and integrity of data, typically through encryption, as part of secure-by-design and secure-by-default.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act)EUR-Lexeur-lex.europa.eu/eli/reg/2024/2847/oj
- CycloneDX Bill of Materials standardOWASP CycloneDXcyclonedx.org/
- EU Agency for Cybersecurity (ENISA)ENISAwww.enisa.europa.eu/
Sources checked in September 2026. Regulations and guidance change; always refer to the issuing body’s current publication. This content is for general information and is not legal advice.