What are the implications of the CRA for Web developers?

[torgo]

• web sites
• web frameworks and libraries
• packaged web applications (e.g. Electron Apps)
• progressive web apps

[SecurityCRob]

I think Recitals 11 & 12 give us the best insights into this particular perspective. These are not part of the law's requirements, but give us indications on how the authors were interpreting things.

"(11) The purpose of this Regulation is to ensure a high level of cybersecurity of products with digital elements and their
integrated remote data processing solutions. Such remote data processing solutions should be defined as data
processing at a distance for which the software is designed and developed by or on behalf of the manufacturer of the
product with digital elements concerned, the absence of which would prevent the product with digital elements from
performing one of its functions. That approach ensures that such products are adequately secured in their entirety by
their manufacturers, irrespective of whether data is processed or stored locally on the user’s device or remotely by
the manufacturer. At the same time, processing or storage at a distance falls within the scope of this Regulation only
in so far as it is necessary for a product with digital elements to perform its functions. Such processing or storage at
a distance includes the situation where a mobile application requires access to an application programming interface
or to a database provided by means of a service developed by the manufacturer. In such a case, the service falls
within the scope of this Regulation as a remote data processing solution. The requirements concerning the remote
data processing solutions falling within the scope of this Regulation do therefore not entail technical, operational or
organisational measures aiming to manage the risks posed to the security of a manufacturer’s network and
information systems as a whole.
(12) Cloud solutions constitute remote data processing solutions within the meaning of this Regulation only if they meet
the definition laid down in this Regulation. For example, cloud enabled functionalities provided by a manufacturer of
smart home devices that enable users to control the device at a distance fall within the scope of this Regulation. On
the other hand, websites that do not support the functionality of a product with digital elements, or cloud services
designed and developed outside the responsibility of a manufacturer of a product with digital elements do not fall
within the scope of this Regulation. Directive (EU) 2022/2555 applies to cloud computing services and cloud service
models, such as Software as a Service (SaaS), Platform as a Service (PaaS) or Infrastructure as a Service (IaaS). Entities
providing cloud computing services in the Union which qualify as medium-sized enterprises under Article 2 of the
Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in
paragraph 1 of that Article, fall within the scope of that Directive."

[SecurityCRob]

key excerpt from above "processing or storage at a distance falls within the scope of this Regulation only
in so far as it is necessary for a product with digital elements to perform its functions."

[fukami]

Web applications are IMHO not in scope of the CRA.

[SecurityCRob]

Yes, I tend to agree, with the caveat that the webpage could be used for some type of enabling/processing for a PDE, which may slide it into scope. A vanilla web presence page would be totally out of scope in my view.

[SecurityCRob]

Fukami helped get us some guidance that may assist in helping our web-friends.

• Hobby projects are out of scope
• Services (like standalone SaaS) which would include websites and pure web-based offering are out of scope for the CRA...but are covered under NIS2
• Cars, medical devices, in vitro devices, certified aeronautical and marine equipment are out of scope for the CRA (because they are covered by other legislation)