← Frameworks / EU CRA / Control Mappings

Machine-readable: JSON API guide

EU Cyber Resilience Act (Regulation 2024/2847)

EU regulation establishing horizontal cybersecurity requirements for products with digital elements. Applies to manufacturers, importers, and distributors of hardware and software sold in the EU. 22 essential cybersecurity requirements in Annex I covering secure-by-design, vulnerability handling, SBOM, coordinated disclosure, and secure update mechanisms. Penalties up to EUR 15M or 2.5% turnover. Reporting obligations from September 2026, full applicability December 2027. Complements NIS2 (which targets operators) with product-level security.

Controls: 121
Total Mappings: 196
Publisher: European Parliament and Council Version: 2024/2847
EU CRA → SP 800-53 SP 800-53 → EU CRA Coverage Analysis
AC (7) AT (1) AU (12) CA (3) CM (7) CP (5) IA (9) IR (6) MA (2) MP (3) PL (3) PM (7) PT (3) RA (3) SA (13) SC (18) SI (14) SR (5)

AC Access Control

Control Name EU CRA References
AC-01 Policy and Procedures
CRA.I.2d
AC-02 Account Management
CRA.I.2d
AC-03 Access Enforcement
CRA.I.2d
AC-04 Information Flow Enforcement
CRA.I.2j
AC-06 Least Privilege
CRA.I.2d
AC-07 Unsuccessful Logon Attempts
CRA.I.2d
AC-17 Remote Access
CRA.I.2d

AT Awareness and Training

Control Name EU CRA References
AT-01 Policy and Procedures
CRA.Info.8a

AU Audit and Accountability

Control Name EU CRA References
AU-01 Policy and Procedures
CRA.I.2l
AU-02 Event Logging
CRA.I.2dCRA.I.2l
AU-03 Content of Audit Records
CRA.I.2dCRA.I.2l
AU-04 Audit Log Storage Capacity
CRA.I.2l
AU-05 Response to Audit Logging Process Failures
CRA.I.2l
AU-06 Audit Record Review, Analysis, and Reporting
CRA.I.2dCRA.I.2l
AU-08 Time Stamps
CRA.I.2l
AU-09 Protection of Audit Information
CRA.I.2fCRA.I.2l
AU-10 Non-repudiation
CRA.I.2f
AU-11 Audit Record Retention
CRA.I.2l
AU-12 Audit Record Generation
CRA.I.2l
AU-14 Session Audit
CRA.I.2l

CA Security Assessment and Authorization

Control Name EU CRA References
CA-02 Control Assessments
CRA.I.2aCRA.II.3
CA-03 Information Exchange
CRA.I.2iCRA.Info.8f
CA-08 Penetration Testing
CRA.I.2aCRA.II.3

CM Configuration Management

Control Name EU CRA References
CM-02 Baseline Configuration
CRA.I.2bCRA.Info.3
CM-03 Configuration Change Control
CRA.I.2cCRA.II.2CRA.II.7CRA.Info.8b
CM-04 Impact Analyses
CRA.II.2CRA.Info.8b
CM-06 Configuration Settings
CRA.I.2bCRA.Info.8a
CM-07 Least Functionality
CRA.I.2bCRA.I.2jCRA.Info.8e
CM-08 System Component Inventory
CRA.II.1CRA.Info.3
CM-12 Information Location
CRA.II.1

CP Contingency Planning

Control Name EU CRA References
CP-01 Policy and Procedures
CRA.I.2h
CP-02 Contingency Plan
CRA.I.2h
CP-07 Alternate Processing Site
CRA.I.2h
CP-09 System Backup
CRA.I.2h
CP-10 System Recovery and Reconstitution
CRA.I.2h

IA Identification and Authentication

Control Name EU CRA References
IA-01 Policy and Procedures
CRA.I.2d
IA-02 Identification and Authentication (Organizational Users)
CRA.I.2d
IA-03 Device Identification and Authentication
CRA.I.2d
IA-04 Identifier Management
CRA.I.2d
IA-05 Authenticator Management
CRA.I.2d
IA-06 Authentication Feedback
CRA.I.2d
IA-08 Identification and Authentication (Non-organizational Users)
CRA.I.2d
IA-11 Re-authentication
CRA.I.2d
IA-12 Identity Proofing
CRA.I.2d

IR Incident Response

Control Name EU CRA References
IR-01 Policy and Procedures
CRA.Art14CRA.II.6CRA.Info.2
IR-04 Incident Handling
CRA.I.2k
IR-05 Incident Monitoring
CRA.Art14
IR-06 Incident Reporting
CRA.Art14CRA.II.4CRA.II.5
IR-07 Incident Response Assistance
CRA.II.6
IR-08 Incident Response Plan
CRA.Art14

MA Maintenance

Control Name EU CRA References
MA-01 Policy and Procedures
CRA.I.2cCRA.II.7
MA-02 Controlled Maintenance
CRA.I.2c

MP Media Protection

Control Name EU CRA References
MP-04 Media Storage
CRA.I.2e
MP-05 Media Transport
CRA.I.2eCRA.I.2m
MP-06 Media Sanitization
CRA.I.2mCRA.Info.8d

PL Planning

Control Name EU CRA References
PL-02 System Security and Privacy Plans
CRA.Info.4CRA.Info.8a
PL-07 Concept of Operations
CRA.Info.4
PL-08 Security and Privacy Architectures
CRA.I.1

PM Program Management

Control Name EU CRA References
PM-05 System Inventory
CRA.II.1CRA.Info.7
PM-07 Enterprise Architecture
CRA.I.1
PM-09 Risk Management Strategy
CRA.Info.5
PM-15 Security and Privacy Groups and Associations
CRA.Art14CRA.II.4CRA.II.5CRA.II.6CRA.Info.2
PM-16 Threat Awareness Program
CRA.II.5
PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research
CRA.I.2g
PM-30 Supply Chain Risk Management Strategy
CRA.I.1

PT Personally Identifiable Information Processing and Transparency

Control Name EU CRA References
PT-02 Authority to Process Personally Identifiable Information
CRA.I.2g
PT-03 Personally Identifiable Information Processing Purposes
CRA.I.2g
PT-06 System of Records Notice
CRA.I.2g

RA Risk Assessment

Control Name EU CRA References
RA-03 Risk Assessment
CRA.Info.5
RA-05 Vulnerability Monitoring and Scanning
CRA.I.2aCRA.II.1CRA.II.2CRA.II.3CRA.Info.5
RA-06 Technical Surveillance Countermeasures Survey
CRA.II.3

SA System and Services Acquisition

Control Name EU CRA References
SA-01 Policy and Procedures
CRA.I.1
SA-02 Allocation of Resources
CRA.I.1
SA-03 System Development Life Cycle
CRA.I.1
SA-04 Acquisition Process
CRA.I.1CRA.I.2bCRA.I.2eCRA.I.2jCRA.II.1CRA.Info.8f
SA-05 System Documentation
CRA.Info.4CRA.Info.5CRA.Info.8aCRA.Info.8bCRA.Info.8cCRA.Info.8dCRA.Info.8eCRA.Info.8f
SA-08 Security and Privacy Engineering Principles
CRA.I.1CRA.I.2bCRA.I.2gCRA.I.2j
SA-09 External System Services
CRA.I.2iCRA.Info.8f
SA-10 Developer Configuration Management
CRA.I.1CRA.I.2f
SA-11 Developer Testing and Evaluation
CRA.I.1CRA.I.2aCRA.II.2CRA.II.3
SA-15 Development Process, Standards, and Tools
CRA.I.1CRA.I.2a
SA-17 Developer Security and Privacy Architecture and Design
CRA.I.1
SA-20 Customized Development of Critical Components
CRA.I.2k
SA-22 Unsupported System Components
CRA.I.2cCRA.II.2CRA.Info.7

SC System and Communications Protection

Control Name EU CRA References
SC-03 Security Function Isolation
CRA.I.2k
SC-05 Denial-of-service Protection
CRA.I.2h
SC-06 Resource Availability
CRA.I.2h
SC-07 Boundary Protection
CRA.I.2iCRA.I.2j
SC-08 Transmission Confidentiality and Integrity
CRA.I.2eCRA.I.2fCRA.II.7
SC-12 Cryptographic Key Establishment and Management
CRA.I.2e
SC-13 Cryptographic Protection
CRA.I.2e
SC-16 Transmission of Security and Privacy Attributes
CRA.I.2f
SC-24 Fail in Known State
CRA.I.2k
SC-28 Protection of Information at Rest
CRA.I.2bCRA.I.2e
SC-29 Heterogeneity
CRA.I.2k
SC-30 Concealment and Misdirection
CRA.I.2k
SC-34 Non-modifiable Executable Programs
CRA.I.2k
SC-35 External Malicious Code Identification
CRA.I.2k
SC-39 Process Isolation
CRA.I.2k
SC-41 Port and I/O Device Access
CRA.I.2j
SC-44 Detonation Chambers
CRA.I.2i
SC-47 Alternate Communications Paths
CRA.I.2i

SI System and Information Integrity

Control Name EU CRA References
SI-02 Flaw Remediation
CRA.I.2aCRA.I.2cCRA.II.2CRA.II.7CRA.II.8CRA.Info.8c
SI-03 Malicious Code Protection
CRA.I.2i
SI-04 System Monitoring
CRA.I.2dCRA.I.2iCRA.I.2l
SI-05 Security Alerts, Advisories, and Directives
CRA.Art14CRA.II.4CRA.II.5CRA.II.8
SI-06 Security and Privacy Function Verification
CRA.II.3
SI-07 Software, Firmware, and Information Integrity
CRA.I.2bCRA.I.2cCRA.I.2fCRA.II.7
SI-10 Information Input Validation
CRA.I.2f
SI-11 Error Handling
CRA.I.2l
SI-12 Information Management and Retention
CRA.I.2gCRA.I.2m
SI-13 Predictable Failure Prevention
CRA.I.2h
SI-16 Memory Protection
CRA.I.2k
SI-17 Fail-safe Procedures
CRA.I.2h
SI-18 Personally Identifiable Information Quality Operations
CRA.I.2m
SI-19 De-identification
CRA.I.2gCRA.I.2m

SR Supply Chain Risk Management

Control Name EU CRA References
SR-01 Policy and Procedures
CRA.I.1
SR-02 Supply Chain Risk Management Plan
CRA.I.1
SR-03 Supply Chain Controls and Processes
CRA.I.1
SR-04 Provenance
CRA.II.1
SR-06 Supplier Assessments and Reviews
CRA.I.2a