[{"data":1,"prerenderedAt":172},["ShallowReactive",2],{"seo-verification":3,"blog-cra-2027-what-the-cyber-resilience-act-changes-for-your-agency-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":22,"featuredImage":24,"bgImage":25,"posterImage":26,"relatedSolution":24,"intro":27,"sections":28,"ctaTitle":112,"ctaBody":113,"ctaButton":114,"ctaUrl":115,"relatedPosts":116},267,"cra-2027-what-the-cyber-resilience-act-changes-for-your-agency",{"fr":10,"en":8,"ar":11},"cra-cyber-resilience-act-hebergement-2027","cra-2027-ما-يغيره-قانون-المرونة-الإلكترونية-لوكالتك","CRA 2027: What the Cyber Resilience Act Changes for Your Agency","The Cyber Resilience Act (CRA) takes full effect in December 2027. What it requires, how it penalizes, and how to prepare your agency starting now.",10,0,false,"2026-08-15T00:00:00+00:00",{"id":14,"name":19,"slug":20,"color":21,"icon":20},"Compliance & Regulation","conformite","bg-amber-500\u002F10 text-amber-400",[23],{"id":14,"name":19,"slug":20,"color":21,"icon":20},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fcra-cyber-resilience-act-hebergement-2027-poster.svg","The Cyber Resilience Act (CRA) — Regulation (EU) 2024\u002F2847, published in the Official Journal on November 20, 2024, in force since December 10, 2024 — imposes binding cybersecurity obligations on manufacturers of products with digital elements placed on the European market for the first time. For a web agency delivering applications, plugins, extensions, or firmware, December 2027 is not an abstract date: it is the deadline after which non-compliance can result in penalties of up to €15 million or 2.5% of worldwide annual turnover.",[29,33,43,46,49,68,71,99,103,106,109],{"type":30,"title":31,"body":32},"h2","What is the Cyber Resilience Act?","The CRA (Regulation (EU) 2024\u002F2847) is a horizontal regulation covering **all products with digital elements** placed on the EU market — whether physical (routers, IP cameras, connected thermostats) or purely software (mobile apps, plugins, libraries, operating systems). It is the first European regulation that applies to **code security** throughout a product's lifecycle.\n\nIt is not a directive transposed differently by each Member State: it is a **regulation**, directly and uniformly applicable in all 27 EU Member States. The full application date is **December 11, 2027** — but the first critical obligation, reporting actively exploited vulnerabilities (to ENISA), applies from **September 11, 2026**.",{"type":34,"title":35,"items":36},"ul","What the CRA Concretely Requires",[37,38,39,40,41,42],"**Security by design**: security risks must be addressed from the design phase, not as post-launch patches.","**No known exploitable vulnerabilities** at market placement: dependencies must be up-to-date and audited.","**Vulnerability management throughout the lifecycle** (minimum 5 years): publish security updates, distribute them for free, inform users.","**Incident reporting**: an actively exploited vulnerability must be notified to ENISA within **24 hours** (early warning) and **72 hours** (full report), from **September 11, 2026**.","**Technical documentation**: secure usage instructions, a vulnerability disclosure policy, and for Class 1\u002F2 products, a SBOM (Software Bill of Materials).","**CE marking**: from 2027, covered products must bear the CRA CE marking.",{"type":30,"title":44,"body":45},"Is Your Agency Affected?","The CRA applies if you **make a product available on the EU market** — covering much more than direct sales:\n- Commercial applications (SaaS, mobile app, boxed software) distributed to European businesses or individuals: yes.\n- Plugins or extensions on marketplaces (WordPress.org, Shopify App Store, Chrome\u002FFirefox extensions): yes.\n- Custom\u002Fwhite-label development where your client sells the product: your client is the manufacturer, but you are a component supplier — and the CRA imposes obligations on suppliers of components integrated into covered products.\n- Open source software distributed **without a commercial model** (no commercial support, no warranty): explicitly exempt — but this exemption may not apply if you provide paid support or integration services.",{"type":30,"title":47,"body":48},"Penalties and Their Logic","The CRA introduces a three-tier sanction regime:\n1. **Violation of essential requirements** (secure design, vulnerability management): up to **€15,000,000** or **2.5% of worldwide annual turnover**.\n2. **Violation of reporting obligations**: up to **€10,000,000** or **2% of worldwide turnover**.\n3. **Providing inaccurate or misleading information**: up to **€5,000,000** or **1% of worldwide turnover**.",{"type":50,"title":51,"steps":52},"steps","Preparing Your Agency Before December 2027",[53,56,59,62,65],{"title":54,"body":55},"Step 1 — Map your products and their classification","Inventory all products you place on the EU market. For each: Default class, Class 1, or Class 2? B2B or B2C? Direct sale, marketplace, or open source + support?",{"title":57,"body":58},"Step 2 — Generate and maintain a SBOM","```bash\n# Syft — SBOM generation (SPDX or CycloneDX format)\ncurl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Fanchore\u002Fsyft\u002Fmain\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\nsynth packages \u002Fpath\u002Fto\u002Fproject -o cyclonedx-json > sbom.json\n\n# Trivy — vulnerability audit from SBOM\ntrivy sbom sbom.json\n```",{"title":60,"body":61},"Step 3 — Establish a vulnerability management process","1. Monitor CVEs for your dependencies (GitHub Dependabot, npm audit, Composer audit, Trivy in CI\u002FCD).\n2. Publish a `security.txt` and `SECURITY.md` in each repository.\n3. Define an internal SLA (e.g. CVSS ≥ 9 → fix within 7 days).\n4. From September 11, 2026: report actively exploited vulnerabilities to ENISA within 24h then 72h.",{"title":63,"body":64},"Step 4 — Document compliance","Technical dossier must include: product and security architecture description, cybersecurity risk analysis, security measures implemented and tests performed, vulnerability management policy, SBOM (mandatory for Class 1\u002F2), secure usage instructions. Keep for **10 years** after market placement.",{"title":66,"body":67},"Step 5 — Document CE Marking and Maintain the Technical File","From December 2027, covered products must bear **CE marking**. Create a technical file containing:\n- Product description and intended use\n- Security risk analysis\n- Generated SBOM\n- Vulnerability disclosure policy\n- Evidence of conformity assessment\n\nThis file must be maintained for **10 years after market placement** — until December 2035 at the latest for products released around the regulation's start date.",{"type":30,"title":69,"body":70},"Impact on Your Hosting Infrastructure","The CRA targets **products with digital elements** — software and hardware with network connectivity. For a web agency, this translates concretely into:\n\n**Third-party dependencies:** if you integrate libraries or CMS plugins into products delivered to clients, these components must come with a **Software Bill of Materials (SBOM)**. Tools: [Syft](https:\u002F\u002Fgithub.com\u002Fanchore\u002Fsyft), [Trivy](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy), [cdxgen](https:\u002F\u002Fgithub.com\u002FCycloneDX\u002Fcdxgen).\n\n**Security update time:** the CRA requires patches for exploited vulnerabilities to be deployed **without undue delay**. In practice, define an update procedure documented in your SLA, with response times.\n\n**VPS and dedicated hosting:** hosted hardware is not directly covered (it is a service, not a product with digital elements), but the software you deploy on it falls under the CRA if you commercialize it.",{"type":72,"title":73,"headers":74,"rows":80},"comparison","CRA vs NIS2 vs GDPR — The Three Key EU Regulations",[75,76,77,78,79],"Regulation","Scope","Who is targeted","Application date","Max penalty",[81,87,93],[82,83,84,85,86],"**CRA** (2024\u002F2847)","Products with digital elements placed on EU market","Manufacturers, importers, distributors of software\u002Fhardware products","Dec 11, 2027 (security) \u002F Sep 11, 2026 (reporting)","€15M or 2.5% turnover",[88,89,90,91,92],"**NIS2** (2022\u002F2555)","Essential and important services (cloud, hosting, energy, finance, health…)","Essential and important operators, cloud\u002FCDN\u002FDNS providers","October 2024 (transposition)","€10M or 2% turnover",[94,95,96,97,98],"**GDPR** (2016\u002F679)","Processing personal data of EU residents","Any data controller or processor","May 2018","€20M or 4% turnover",{"type":100,"title":101,"body":102},"tip","Free SBOM Tools to Add to Your CI\u002FCD","Automatic SBOM generation at each build is the most cost-effective CRA preparation measure. Three open-source tools:\n\n**Syft** — generates SBOM in SPDX 2.3 or CycloneDX 1.5 format.\n**Trivy** — scans vulnerabilities from a CycloneDX SBOM or Docker image.\n**cdxgen** — specialized for Node.js, Python, PHP, Go, Java, Ruby projects:\n```bash\nnpx @cyclonedx\u002Fcdxgen -t php \u002Fmy-project -o sbom-php.json\n```",{"type":30,"title":104,"body":105},"Compliance Timeline — Don't Miss the First Two Deadlines","| Deadline | Obligation |\n|---|---|\n| **Dec 10, 2024** | Regulation enters into force |\n| **Sep 11, 2026** | Obligation to report actively exploited vulnerabilities to ENISA (24h\u002F72h) |\n| **Dec 11, 2027** | Full application: all essential requirements, CE marking, documentation |\n\n**The mistake to avoid**: treating September 11, 2026 as minor. If a vulnerability in your product is actively exploited after that date and you did not report it to ENISA within the deadlines, you are already in violation — more than a year before the CRA's full application.\n\n**Technical file retention:** the CRA requires keeping the technical dossier for **10 years after product market placement** — meaning until **December 2035** for the first products placed under the CRA in the start of the transition period.",{"type":30,"title":107,"body":108},"ServOrbit and Your CRA Compliance","As a host, ServOrbit plays a complementary role in your CRA compliance:\n\n**Managed and secured infrastructure:** our VPS servers run on hardened Debian 12 (updated kernel, automatic security patches). Your applications run on a certified base.\n\n**Automated backups:** an exploited vulnerability requires incident response. Having daily backups reduces the risk window.\n\n**Dedicated technical support:** our team can assist you in setting up monitoring (SigNoz, Beszel) and automated vulnerability scanning for your deployments.\n\nCRA compliance is not a one-time effort: it requires a **maintainable DevSecOps chain**.",{"type":30,"title":110,"body":111},"Next Steps to Get Ready Before December 2027","The CRA comes into force in December 2027 — 18 months from now. Three concrete actions to implement now:\n\n**1. Map your exposure:** list products with digital elements that you develop or commercialize. A SaaS delivered to clients is likely covered.\n\n**2. Set up an SBOM pipeline:** integrate Syft or Trivy into your CI\u002FCD to generate a  for each release. Free and non-intrusive.\n\n**3. Document your vulnerability management process:** create an internal procedure (detection → triage → patch → client notification). This documentation will be requested by auditors.\n\nFor regulated architectures, consider [CRA self-assessment checklists](https:\u002F\u002Fwww.enisa.europa.eu\u002Fpublications\u002Fenisa-report-cyber-resilience-act) from ENISA.","European Hosting for Your CRA Compliance","Your products need a documentable, EU-based infrastructure that gives you full access to your logs. Our VPS plans give you complete control over your stack — and the audit trail your CRA file needs.","See our agency plans","\u002Fsolutions\u002Fagences",[117,131,152],{"id":118,"slug":119,"slugs":120,"title":123,"excerpt":124,"readTime":125,"views":15,"isPinned":16,"publishedAt":126,"category":127,"categories":128,"featuredImage":24,"bgImage":25,"posterImage":130,"relatedSolution":24},211,"nis2-what-the-directive-requires-from-your-hosted-clients",{"fr":121,"en":119,"ar":122},"nis2-hebergement-obligations-clients-2026","nis2-ما-تفرضه-التوجيهات-على-عملائكم-المستضافين","NIS2: what the directive requires from your hosted clients","NIS2 applies from October 2026 across the EU. Clients in essential sectors must choose providers that meet the same security standards.",4,"2026-08-02T00:00:00+00:00",{"id":14,"name":19,"slug":20,"color":21,"icon":20},[129],{"id":14,"name":19,"slug":20,"color":21,"icon":20},"\u002Fblog\u002Fcovers\u002Fnis2-hebergement-obligations-clients-2026-poster.svg",{"id":132,"slug":133,"slugs":134,"title":137,"excerpt":138,"readTime":125,"views":15,"isPinned":16,"publishedAt":139,"category":140,"categories":146,"featuredImage":24,"bgImage":25,"posterImage":148,"relatedSolution":149},108,"securing-your-vps-with-crowdsec",{"fr":135,"en":133,"ar":136},"securiser-vps-crowdsec","تأمين-خادمك-الافتراضي-vps-باستخدام-crowdsec","Securing your VPS with CrowdSec","Deploy CrowdSec on your VPS to block attacks thanks to behavioral detection and a shared community blocklist.","2026-03-04T00:00:00+00:00",{"id":141,"name":142,"slug":143,"color":144,"icon":145},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[147],{"id":141,"name":142,"slug":143,"color":144,"icon":145},"\u002Fblog\u002Fcovers\u002Fsecuriser-vps-crowdsec-poster.svg",{"categorySlug":150,"appSlug":151},"cybersecurity-bastion","crowdsec",{"id":153,"slug":154,"slugs":155,"title":158,"excerpt":159,"readTime":125,"views":15,"isPinned":16,"publishedAt":160,"category":161,"categories":167,"featuredImage":24,"bgImage":25,"posterImage":169,"relatedSolution":170},160,"how-to-self-host-infisical-on-a-vps",{"fr":156,"en":154,"ar":157},"self-host-infisical-vps","كيفية-استضافة-infisical-ذاتيا-على-خادم-vps","How to Self-Host Infisical on a VPS","Deploy Infisical on your VPS: an open-source secrets manager centralising API keys, env vars and certificates in a self-hosted vault, with SDK hooks and audit logs.","2026-07-02T00:00:00+00:00",{"id":162,"name":163,"slug":164,"color":165,"icon":166},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[168],{"id":162,"name":163,"slug":164,"color":165,"icon":166},"\u002Fblog\u002Fcovers\u002Fself-host-infisical-vps-poster.svg",{"categorySlug":150,"appSlug":171},"infisical",1787580993856]