Year: 2025
Type: article
Abstract: The European Union’s Cyber Resilience Act (CRA) introduces a complex set of binding lifecycle security obligations, presenting a significant compliance challenge for the Internet of Things (IoT) industry. This study addresses this challenge by developing a comprehensive CRA mapping framework specifically tailored to the IoT sector. The core contribution is a detailed lifecycle-based checklist that translates the regulation’s legal mandates into an actionable blueprint for manufacturers. Beyond the checklist itself, this paper’s core contribution is a transparent two-phase methodology. The first phase provides a structured pipeline to translate dense legal text (from CRA Articles 13–14 and its annexes) into atomic testable engineering requirements. The second phase builds a quantitative rating tree using the Analytic Hierarchy Process (AHP) to weigh these requirements, providing a consistent and evidence-based scoring rubric. By synthesizing the complex regulatory landscape and the technical state of the art, this paper operationalizes the CRA’s requirements for governance, secure design, vulnerability management, and conformity assessment. The framework is validated in the TRUEDATA case, yielding a weighted readiness score and a sensitivity analysis that underpin the reliability of the findings.
Source: Information
DOI: 10.3390/info16121017
Authors: Miguel Ángel Ortega Velázquez, Iris Cuevas Martínez, Antonio J. Jara
Institution: Universidad Politécnica de Cartagena
Language: English
Subfield: Law
Field: Social Sciences
Domain: Social Sciences
Open Access status: gold
Estimated APC paid: $1,930
Funder: Fundación Séneca
Award: G3812436043
OpenAlex ID: W4416598951