Cyber Resilience Act (CRA)
The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, sets mandatory cybersecurity requirements for hardware and software "products with digital elements" sold in the EU. It entered into force on 10 December 2024; manufacturers' vulnerability and incident reporting duties apply from 11 September 2026 and most other obligations from 11 December 2027 (European Commission).
Two of its essential requirements (Annex I, Part I) are identity requirements: products must "ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems", report possible unauthorised access, and ship with "a secure by default configuration". The Act does not use the words "default password", but a shared factory credential is hard to square with secure by default. Identity vendors are also directly in scope: Annex III lists "identity management systems and privileged access management software and hardware", including biometric readers, and password managers as Class I important products, which need third-party assessment unless the manufacturer fully applies harmonised standards or a certification scheme. From 11 September 2026 a manufacturer must send an early warning of an actively exploited vulnerability within 24 hours, and fines for breaching the essential requirements reach 15 million euros or 2.5 percent of worldwide turnover.
See also: Cyber Resilience Act in the regulations hub, NIS2, identity controls for NIS2, password manager, PAM
Related on Start with Identity
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a
- CVEBeyondTrust PRA and Remote Support unauthenticated command injection
Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM
- BlogBeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. M
- CVEBeyondTrust Remote Support zero-day, from file upload to the whole credential vault
An origin-validation flaw in self-hosted BeyondTrust Remote Support through 26.2.3 let ARMORY CASTLE plant a web shell, export every vaulted admin credential, a
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- GlossaryCIAM
CIAM (customer identity and access management) is the set of systems that handle registration, login, profiles, consent, and access for an application's externa