EU Cyber Resilience Act (CRA)

Adopted in 2024, the EU Cyber Resilience Act (CRA) establishes clear cybersecurity requirements for all products with digital elements, including software, hardware, and IoT devices. Its core objective is to ensure end-to-end security across the entire product lifecycle.

Under the CRA, products must be placed on the market without any known exploitable vulnerabilities, and manufacturers are required to implement mechanisms for vulnerability disclosure, timely remediation, and continuous security updates throughout the product’s operational life. Manufacturers must also maintain documentation that promote supply chain security, such as Software Bill of Materials (SBOMs). For certain high-risk products, third-party certification is mandatory.

Failing to meet these requirements can be costly. Companies failing to meet the cybersecurity requirements or the reporting requirements can be fined up to €15 million or 2.5% of their global turnover, whichever is higher. EU member state authorities can also mandate product withdrawal from its market. Combined with the loss of the CE marking, noncompliance companies and products are essentially shut off from the European market.

To learn more about the challenges and opportunities that come with EU CRA, visit EU Cyber Resilience Act compliance with Lucent Sky AVM.

NIS2 Directive and the Revised Product Liability Directive

To strengthen cybersecurity across the EU’s critical infrastructure and essential digital services, the NIS2 Directive significantly expands the scope and obligations of its predecessor. It applies to a broad range of sectors—including finance, healthcare, transportation, ICT, infrastructure, and public administration—and mandates that medium and large entities implement robust cybersecurity risk management measures.

• Key NIS2 requirements include:
• Supply chain security
• Incident detection and reporting
• Continuous monitoring and response
• Executive accountability, with senior management held liable for non-compliance

Another EU directive on cybersecurity is the revised EU Product Liability Directive. The original directive adopted in 1985 established the principle of strict liability for defective products. The 2024 revision modernizes the framework by explicitly including software, AI systems, and digital services within the definition of a “product.” Member states are required to transpose the new directive into national law by December 9, 2026.

Key updates in the revised PLD include:

• Cybersecurity vulnerabilities and failure to provide updates can now be considered product defects
• Strict liability applies to software developers, importers, and digital service providers
• Reversal of the burden of proof in certain cases, making it easier for injured parties to claim compensation

Together, NIS2 and the revised PLD mark a significant shift: cybersecurity is no longer just an operational concern, it has become a matter of legal accountability. Organizations must adopt a comprehensive cybersecurity governance framework that integrates policy, technical controls, and documentation to meet these evolving regulatory demands.

ISO/IEC 27001

ISO/IEC 27001 is the world’s leading standard for information security management systems (ISMS). It provides a comprehensive framework for organizations to systematically manage sensitive information, mitigate risks, and ensure business continuity.

The standard covers a wide range of security domains, including:

• Information security policies
• Risk assessment and treatment
• Access control and data protection
• Human resource security
• Incident response and recovery planning

The 2022 revision emphasizes a risk-based approach and aligns more closely with other ISO management system standards. It encourages organizations to take a holistic view of security, integrating people, processes, and technology.

A critical part of ISO 27001 compliance is the identification and remediation of vulnerabilities in applications and systems. Organizations are expected to:

• Regularly assess software and digital assets for security flaws
• Implement timely remediation measures
• Maintain audit trails and documentation of security controls and corrective actions

These practices are essential for demonstrating effective risk treatment and continuous improvement, both of which are core principles of ISO 27001 and key criteria of achieving certification.

PCI DSS: Payment Card Industry Data Security Standard

PCI DSS is a global security standard jointly developed by major payment card brands such as Visa, Mastercard, American Express, and JCB. It sets comprehensive requirements for protecting cardholder data during storage, processing, and transmission. Organizations that handle payment card information, including banks, payment processors, e-commerce platforms, and retailers, must comply with PCI DSS to ensure the security of their payment environments.

The latest version, PCI DSS v4.0 (and its latest revision, v4.0.1), replaces v3.2.1 and introduces significant enhancements—especially in application security.

Compared to v3.2.1, PCI DSS v4.0.1 introduces a more proactive approach to secure software development and vulnerability management:

• Maintaining an inventory of bespoke and custom software, and incorporated third-party components, so vulnerabilities in third-party components cannot be exploited.
• Assuring the authorization and integrity of payment page scripts.
• Protecting passwords for applications and accounts against misuse, such as avoiding hard-coding them in source code
• Conducting internal vulnerability scans after significant changes, including application updates, rather than on a periodic basis

These updates reflect a shift from reactive compliance to continuous security assurance. Organizations are now expected to integrate application security testing, secure coding practices, and remediation workflows into their software development lifecycle.

Meeting global cybersecurity standards with Lucent Sky AVM

Across major cybersecurity regulations—including the EU Cyber Resilience Act (CRA), NIS2 Directive, Product Liability Directive, ISO/IEC 27001, and PCI DSS—four common priorities consistently emerge:

• Vulnerability and supply chain security: organizations must manage both their own software and third-party components to prevent vulnerabilities from being introduced through the software supply chain.
• Continuous improvement and remediation: emphasis on the needs for ongoing vulnerability tracking and remediation—not just one-time scans, but continuous security assessments.
• Proactive risk management: security must be embedded early in the development lifecycle, with a focus on secure design and preventive controls rather than reactive fixes.
• Documentation and audit readiness: regulations require detailed technical documentation, including security reports, SBOMs, and audit trails, to support compliance and incident response.

As a solution purpose-built for application vulnerability remediation, Lucent Sky AVM offers unique capabilities that help organizations meet these regulatory expectations:

1. Automated vulnerability detection and remediation - Lucent Sky AVM analyzes source code, binaries, and software components to identify both known and unknown vulnerabilities. It can automatically remediate code-level flaws and suggest updates for vulnerable dependencies—ensuring that products are released without known vulnerabilities.
2. Integration with the software development lifecycle (SDLC) - Lucent Sky AVM integrates with popular development tools and supports modern development methodologies, enabling the detection and remediation of security issues early and throughout the software development lifecycle.
3. Comprehensive reporting and standards alignment - Reports include vulnerability details and remediation, promoting effective adherence to regulations such as the EU CRA and industry standards such as OWASP Top 10 and PCI DSS. Digitally signed reports and SBOMs in standard formats also fulfill the technical documentation requirements of modern cybersecurity regulations.

Accelerating compliance through actionable security

Whether engaged in cross-border trade and government procurement, or complying with customer audits or supply chain resiliency requirements, understanding these cybersecurity standards has become a critical requirement for modern enterprises. Effectively and efficiently complying with these regulations not only enhances product security and resilience—it also strengthens the organization’s competitive edge.

Lucent Sky offers a comprehensive solution to help organizations meet stringent information security requirements and accelerate their software security processes. Get in touch to learn how Lucent Sky AVM can help your organization accelerate compliance with international cybersecurity standards.