--- title: "CRA standards tracker | Edge SDN" description: "Where each harmonised standard for the Cyber Resilience Act stands: committee, stage, date and deadline under standardisation request M/606." url: https://www.edge-sdn.com/regulations/cyber-resilience-act/standards/ last_updated: 2026-10-16 --- # CRA standards tracker Every European standard written for the Cyber Resilience Act under standardisation request M/606, with its stage and the deadline it answers. We update the table when a committee moves a standard. **No harmonised standard for the CRA is cited in the Official Journal yet. No product can claim presumption of conformity under Article 27 today. Assess against the essential requirements of Annex I directly.** https://single-market-economy.ec.europa.eu/single-market/goods/european-standards/harmonised-standards_en The deadlines in the last column come from a draft amendment to request M/606, notified by the Commission on 7 July 2026 with feedback closed on 3 August 2026. It is not adopted. The original deadlines are shown crossed out. https://single-market-economy.ec.europa.eu/single-market/goods/european-standards/notification-system_en Checked on 16 October 2026. ## Horizontal standards | Reference | Title | Stage | Stage date | M/606 deadline | | --- | --- | --- | --- | --- | | EN 40000-1-1 (JTC 13 WG 9) | Cybersecurity requirements for products with digital elements, Part 1-1: Vocabulary | Formal vote | 1 October 2026 | – | | EN 40000-1-2 (JTC 13 WG 9) | Part 1-2: Principles, product risk management and lifecycle activities | Formal vote | 1 October 2026 | 30 October 2026 | | prEN 40000-1-3 (JTC 13 WG 9) | Part 1-3: Vulnerability handling | Draft for enquiry | 5 March 2026 | 30 October 2026 | | prEN 40000-1-4 (JTC 13 WG 9) | Part 1-4: Generic security requirements | Work item | 5 March 2025 | 30 October 2027 | ## Vertical standards, ETSI | Reference | Title | Stage | Stage date | M/606 deadline | | --- | --- | --- | --- | --- | | EN 304 617 (TC CYBER WG EUSR) | Cybersecurity requirements for browsers | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 618 (TC CYBER WG EUSR) | Cybersecurity requirements for password managers | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 619 (TC CYBER WG EUSR) | Cybersecurity requirements for software that searches for, removes or quarantines malicious software | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 620 (TC CYBER WG EUSR) | Cybersecurity requirements for virtual private networks | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 621 (TC CYBER WG EUSR) | Cybersecurity requirements for network management systems | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 622 (TC CYBER WG EUSR) | Cybersecurity requirements for security information and event management systems | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 623 (TC CYBER WG EUSR) | Cybersecurity requirements for boot managers | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 624 (TC CYBER WG EUSR) | Cybersecurity requirements for public key infrastructure and digital certificate issuance software | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 625 (TC CYBER WG EUSR) | Cybersecurity requirements for physical and virtual network interfaces | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 626 (TC CYBER WG EUSR) | Cybersecurity requirements for operating systems | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 627 (TC CYBER WG EUSR) | Cybersecurity requirements for routers, modems intended for the connection to the internet and switches | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 631 (TC CYBER WG EUSR) | Cybersecurity requirements for smart home general purpose virtual assistants | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 632 (TC CYBER WG EUSR) | Cybersecurity requirements for smart home products with security functionalities | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 633 (TC CYBER WG EUSR) | Cybersecurity requirements for internet connected toys with social interactive or location tracking features | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 634 (TC CYBER WG EUSR) | Cybersecurity requirements for personal wearable health monitoring products and children's wearables | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 635 (TC CYBER WG EUSR) | Cybersecurity requirements for hypervisors and container runtime systems | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 636 (TC CYBER WG EUSR) | Cybersecurity requirements for firewalls, intrusion detection and prevention systems | Draft for enquiry | 13 August 2026 | 31 December 2026 | | EN 304 642 (TC CYBER WG EUSR) | Cybersecurity requirements for network functions of telecommunications systems | Work item | 31 July 2026 | – | ## Vertical standards, CEN and CENELEC | Reference | Title | Stage | Stage date | M/606 deadline | | --- | --- | --- | --- | --- | | prEN 40000-10 (TC 224 WG 17) | Part 10: Products with digital elements used in identity management systems and privileged access management software and hardware, including authentication and access control readers | Draft for enquiry | 13 August 2026 | 31 December 2026 | | prEN 40000-11 (TC 224 WG 17) | Part 11: Hardware devices with security boxes | Draft for enquiry | 13 August 2026 | 31 December 2026 | | prEN 18330 (TC 224) | Cybersecurity requirements for smartcards or similar devices, including secure elements, application layer | Draft for enquiry | 9 April 2026 | 31 December 2026 | | prEN 40001-3 (TC 47X) | Cybersecurity requirements for microprocessors and microcontrollers with security-related functionalities | Draft for enquiry | 10 April 2026 | 31 December 2026 | | prEN 40002-3 (TC 47X) | Cybersecurity requirements for tamper-resistant microprocessors and microcontrollers | Draft for enquiry | 10 April 2026 | 31 December 2026 | | prEN 40003-3 (TC 47X) | Cybersecurity requirements for platforms of smartcards and similar devices including secure elements | Draft for enquiry | 10 April 2026 | 31 December 2026 | | prEN 40004-3 (TC 47X) | Cybersecurity requirements for FPGAs and ASICs with security-related functionalities | Draft for enquiry | 25 September 2026 | 31 December 2026 | ## Industrial automation (OT) and supporting work | Reference | Title | Stage | Stage date | M/606 deadline | | --- | --- | --- | --- | --- | | prEN 50770-1 (TC 65X WG 3) | Security for operational technologies, Part 1: Security profile for firewalls and intrusion detection and prevention systems (based on EN IEC 62443) | Work item | 21 October 2025 | 31 December 2026 | | prEN 50770-2 (TC 65X WG 3) | Part 2: Security profile for network management systems | Work item | 27 December 2025 | 31 December 2026 | | prEN 50770-3 (TC 65X WG 3) | Part 3: Security profile for physical and virtual network interfaces | Work item | 27 December 2025 | 31 December 2026 | | prEN 50770-4 (TC 65X WG 3) | Part 4: Security profile for products with the function of VPN | Work item | 21 October 2025 | 31 December 2026 | | prEN 50770-5 (TC 65X WG 3) | Part 5: Security profile for routers, modems intended for the connection to the internet and switches | Work item | 21 October 2025 | 31 December 2026 | | prEN 50770-6 (TC 65X WG 3) | Part 6: Security profile for SIEM systems | Work item | 21 October 2025 | 31 December 2026 | | EN IEC 62443-4-1:2018/prAA:2026 (TC 65X) | Secure product development lifecycle requirements, CRA-related amendment | Draft for enquiry | 5 June 2026 | – | | EN IEC 62443-4-2:2019/prAA:2026 (TC 65X) | Technical security requirements for IACS components, CRA-related amendment | Draft for enquiry | 5 June 2026 | – | | EN IEC 62443-3-3:2019/prAA (TC 65X) | System security requirements and security levels, amendment | Work item | 27 June 2024 | – | | prEN (smart meter gateway) (JTC 13 WG 6) | Cybersecurity requirements for products with digital elements, smart meter gateway | Work item | 9 March 2026 | 31 December 2026 |