A CRA Roadmap for Marine Equipment Suppliers
From scoping to a running vulnerability desk: six steps, the right kind of help, and a checklist
The first four parts explained what the EU Cyber Resilience Act is, what it costs to get wrong, what E27 evidence still lacks and how to prove behaviour by test. This last part puts it in order: six steps a marine equipment supplier can follow between now and 11 December 2027, how to choose the kind of outside help that fits, and a checklist to measure progress.
EU CRA for Marine Equipment Makers: the series
- What the CRA is and how it differs from IACS UR E26/E27
- The CRA in numbers: fines, deadlines and the reporting clock
- From E27 evidence to CRA evidence: what suppliers must add
- Proving security, function and recovery by test
- A CRA roadmap for marine equipment suppliers (this article)
1. Two Starting Points
Where a supplier starts depends on the product's stage and on what the company can do itself.
| Product still in development | Product finished, needs to show conformity | |
|---|---|---|
| Typical situation | Security functions still need to be designed and built in, so help is needed with requirements, design and implementation | The company can develop and fix its own product, but needs help interpreting the CRA and judging and proving how well it meets it |
| Main activities | Define security requirements and review the design; build and improve the security functions; design and run tests and analyse defects; prepare procedures, technical documentation and assessment | Check scope, product class and existing evidence; gap analysis and risk assessment per requirement; plan improvements and tests; review results; prepare procedures, technical documentation and assessment |
| Result | Security built into the product from modification through to conformity | Conformity established for a product the company develops itself |
2. Six Steps to December 2027
Step 6 is not the last thing to do; parts of it are already due. A supplier that has nothing else in place should set up the reporting and vulnerability intake side of step 6 first, because Article 14 has applied since 11 September 2026 (Part 2).
3. Who Does What Around the Supplier
The CRA puts the duties on the manufacturer, but the shipyard and owner shape whether they work in practice.
| Party | Role in making the CRA work for a ship |
|---|---|
| Equipment supplier | Meets its CRA duties; declares the support period; provides the DoC, update policy and security contact; notifies users of exploited vulnerabilities and fixes |
| Shipyard / system integrator | Asks for CRA status, DoC, SBOM availability and support period at the RFQ stage; links supplier evidence to the E26 vessel asset inventory and design documents |
| Shipowner / manager | Builds supplier notices into its own incident and patch processes; plans for equipment whose support ends before the ship's life does |
How supplier notices actually reach the ship, and the contract clauses that close the gaps, are covered in Julius Shin's article Does CRA Vulnerability Reporting Reach the Shipowner?
4. Choosing the Right Kind of Outside Help
Most marine equipment makers will use some outside support. It helps to know which kind of question each type answers.
| Type of support | The question it answers | What it typically includes |
|---|---|---|
| Conformity diagnosis and improvement | "Which requirements apply to our product, and what do we need to add?" | Scope and class review, review of existing evidence, gap analysis and risk assessment per requirement, improvement plan, help with procedures, technical documentation and assessment |
| Security, function and recovery testing | "Can we prove by actual behaviour that the product meets the requirements and that our fixes worked?" | Unauthorised access, malformed traffic and load tests; checks that functions survive and recover through update or communication failures; defect analysis and retest after changes |
| An in-house test environment | "What do we need to test ourselves every time a product or version changes?" | Product-specific test connections, reproduction of operating signals and measurement; repeatable scenarios with logging and reporting; procedures, training and maintenance |
Before engaging anyone, the supplier should have its product list and existing evidence in hand. The scope of development, fixes, tests and documentation can only be agreed once both sides know what already exists.
5. A Ten-Point Checklist
- 1 We know which of our products and variants are on the EU market, and which are MED items.
- 2 Each in-scope product has a class and a chosen conformity procedure.
- 3 We can receive vulnerability reports through a published contact, and someone owns them.
- 4 We can decide within hours whether a vulnerability is actively exploited, and file an early warning within 24 hours.
- 5 Each product has a machine-readable SBOM linked to vulnerability data.
- 6 Our E27 evidence is mapped against Annex I, with every gap assigned to an owner.
- 7 Security, function and recovery tests exist for each product, with records per version.
- 8 Each product has a declared support period with written reasoning, and a plan for when it ends.
- 9 Security updates are signed, verified on install, tested for recovery, free of charge and kept available for at least ten years.
- 10 Technical documentation and the EU declaration of conformity will be ready, and kept for at least ten years.
※ Harmonised standards, implementing acts and Commission guidance under the CRA continue to be published. Review this roadmap against the latest official EU sources before each step.
Over five parts, one idea has run through the series: E27 asks whether a system was secure when the ship was delivered; the CRA asks whether the maker is still looking after it. The technical work overlaps a great deal. The real change is organisational: someone in the company has to own a product's security for as long as it is supported.
Suppliers that start with that ownership, and build the documents and tests around it, will find December 2027 manageable. Suppliers that start with the documents will find the reporting clock catches them first.
Primary sources:
| Regulation / standard | Type | Link |
|---|---|---|
| EU CRA, Regulation (EU) 2024/2847 | EUR-Lex | View text ↗ |
| IACS UR E27 Rev.1 (Sep 2023) | Download PDF ↗ | |
| CRA requirements–standards mapping | Download PDF ↗ |
Related reading:
Maritime 4.0 · shipyard-side experience in maritime cybersecurity and IACS UR E26/E27 compliance, writing at the intersection of AI, data, and ship cyber resilience.
⚓ Join the ShipPaulJobs Community
Join →
Comments
Post a Comment