[{"data":1,"prerenderedAt":367},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/cyber-resilience-act-september-2026-microsoft-smes-public-sector-posts_en":51,"/en/blog/cyber-resilience-act-september-2026-microsoft-smes-public-sector-surround-posts_en":356},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":318,"description":319,"extension":320,"faq":321,"howto":331,"image":348,"meta":350,"navigation":351,"path":352,"seo":353,"stem":354,"__hash__":355},"posts_en/en/3.blog/19.cyber-resilience-act-september-2026-microsoft-smes-public-sector.md","The Cyber Resilience Act, Simply Explained – Safer Software for All",[55],{"name":56,"to":57,"avatar":58},"Michael Wolf","/en/about",{"src":59},"/michael.webp",{"label":61},"News",{"type":63,"value":64,"toc":306},"minimark",[65,69,78,83,86,114,117,121,128,139,143,146,150,177,181,190,194,226,230,233,285,288,292,299],[66,67,53],"h1",{"id":68},"the-cyber-resilience-act-simply-explained-safer-software-for-all",[70,71,72,73,77],"p",{},"Software and connected devices are everywhere – in the office, in the practice and at home. With the ",[74,75,76],"strong",{},"Cyber Resilience Act (CRA)",", the EU is making sure such products are more secure from the start and that security holes get fixed quickly. For you as a user, that's really good news.",[79,80,82],"h2",{"id":81},"what-does-the-cra-cover","What does the CRA cover?",[70,84,85],{},"The CRA is an EU regulation that entered into force at the end of 2024 and takes effect step by step. It applies to \"products with digital elements\" – software and devices that connect to other devices or the internet. The key points:",[87,88,89,96,102,108],"ul",{},[90,91,92,95],"li",{},[74,93,94],{},"Security from the start:"," Products should be developed and shipped securely.",[90,97,98,101],{},[74,99,100],{},"Security updates:"," Manufacturers must provide updates for an appropriate period.",[90,103,104,107],{},[74,105,106],{},"Reporting obligations:"," Manufacturers must report actively exploited vulnerabilities and serious incidents. These obligations apply from September 2026.",[90,109,110,113],{},[74,111,112],{},"Transparency:"," Users should be told how long updates will be available.",[70,115,116],{},"The full requirements then apply from the end of 2027.",[79,118,120],{"id":119},"who-does-the-cra-affect","Who does the CRA affect?",[70,122,123,124,127],{},"The obligations are on ",[74,125,126],{},"manufacturers, importers and distributors",". If you only use software or devices, you don't have to report anything. But you benefit:",[87,129,130,133,136],{},[90,131,132],{},"You get clearer information about updates.",[90,134,135],{},"Security holes are closed faster.",[90,137,138],{},"You can compare products better when buying.",[79,140,142],{"id":141},"and-open-source","And open source?",[70,144,145],{},"The CRA takes open source into account. Anyone who develops and shares open-source software without commercial intent generally doesn't fall under the full manufacturer obligations. Foundations and organisations that support open-source projects on an ongoing basis have their own role with lighter obligations. Many large open-source projects already have good processes for reporting and fixing security issues.",[79,147,149],{"id":148},"what-can-you-actually-do","What can you actually do?",[151,152,153,159,165,171],"ol",{},[90,154,155,158],{},[74,156,157],{},"Get an overview:"," Which programs and connected devices do you use?",[90,160,161,164],{},[74,162,163],{},"Turn on updates:"," Automatically where possible, otherwise regularly.",[90,166,167,170],{},[74,168,169],{},"Ask when buying:"," How long will there be security updates?",[90,172,173,176],{},[74,174,175],{},"Replace old devices:"," When there are no more updates, it's time for something new.",[79,178,180],{"id":179},"how-open-source-helps","How open source helps",[70,182,183,184,189],{},"With open-source software like Nextcloud, Element or Vaultwarden, you can follow security notices and updates publicly. And because you decide where the software runs, updates are in your hands too – or your provider installs them for you. You'll find more alternatives under ",[185,186,188],"a",{"href":187},"/en/alternativen","Alternatives",".",[79,191,193],{"id":192},"a-few-terms-briefly-explained","A few terms, briefly explained",[87,195,196,202,208,214,220],{},[90,197,198,201],{},[74,199,200],{},"Product with digital elements:"," Software or hardware that can be connected to other devices or networks.",[90,203,204,207],{},[74,205,206],{},"Vulnerability:"," A flaw in software that attackers could exploit.",[90,209,210,213],{},[74,211,212],{},"Actively exploited vulnerability:"," A flaw for which there are signs that it's already being used in attacks.",[90,215,216,219],{},[74,217,218],{},"Support period:"," The time span during which the manufacturer provides security updates.",[90,221,222,225],{},[74,223,224],{},"SBOM (software bill of materials):"," A parts list of the components a piece of software is made of.",[79,227,229],{"id":228},"what-to-look-for-when-you-next-buy-something","What to look for when you next buy something",[70,231,232],{},"Whether router, printer, camera or software – a few questions help you choose:",[234,235,236,249],"table",{},[237,238,239],"thead",{},[240,241,242,246],"tr",{},[243,244,245],"th",{},"Question",[243,247,248],{},"Why it helps",[250,251,252,261,269,277],"tbody",{},[240,253,254,258],{},[255,256,257],"td",{},"How long will there be security updates?",[255,259,260],{},"The longer, the longer you can use the product safely",[240,262,263,266],{},[255,264,265],{},"Do updates install automatically?",[255,267,268],{},"Saves work and closes gaps faster",[240,270,271,274],{},[255,272,273],{},"Is there a contact for security reports?",[255,275,276],{},"Shows the manufacturer takes the topic seriously",[240,278,279,282],{},[255,280,281],{},"Can the default password be changed?",[255,283,284],{},"Basic protection that sadly isn't a given everywhere",[70,286,287],{},"This is especially worth checking with inexpensive connected devices – a device without updates can become the weak spot in your whole network.",[79,289,291],{"id":290},"conclusion","Conclusion",[70,293,294,295,189],{},"The Cyber Resilience Act makes software and devices safer for everyone. For you, it mainly means: keep an eye on updates and ask about the support period when buying. If you'd like an assessment, have a look at ",[185,296,298],{"href":297},"/en/consulting","Consulting",[70,300,301,302,189],{},"If you'd like to give it a try, I'm happy to help – ",[185,303,305],{"href":304},"/en/contact","just drop me a line",{"title":307,"searchDepth":308,"depth":308,"links":309},"",2,[310,311,312,313,314,315,316,317],{"id":81,"depth":308,"text":82},{"id":119,"depth":308,"text":120},{"id":141,"depth":308,"text":142},{"id":148,"depth":308,"text":149},{"id":179,"depth":308,"text":180},{"id":192,"depth":308,"text":193},{"id":228,"depth":308,"text":229},{"id":290,"depth":308,"text":291},"2026-07-07T00:00:00.000Z","The Cyber Resilience Act brings more security to software and connected devices. What it covers and what it means for your everyday life.","md",[322,325,328],{"q":323,"a":324},"What is the Cyber Resilience Act?","The Cyber Resilience Act (CRA) is an EU regulation that sets minimum cybersecurity standards for products with digital elements. That includes software and connected devices.",{"q":326,"a":327},"Do I have to report anything as a software user?","No. The CRA's reporting and security obligations are aimed at manufacturers, importers and distributors. As a user, you benefit from better security and clearer information about updates.",{"q":329,"a":330},"What does the CRA mean for open source?","The CRA gives open source special consideration. Anyone who develops and shares open-source software without commercial intent generally doesn't fall under the full manufacturer obligations. Organisations that support open-source projects on an ongoing basis have their own, lighter role.",{"name":332,"description":333,"totalTime":334,"steps":335},"Keeping an eye on software security day to day","Four simple steps to benefit from more secure software.","P1W",[336,339,342,345],{"name":337,"text":338},"List devices and programs","Note which software and connected devices are used in your business or at home.",{"name":340,"text":341},"Turn on updates","Enable automatic updates wherever possible and schedule a fixed monthly slot for the rest.",{"name":343,"text":344},"Mind support periods","When buying new devices or software, check how long security updates will be provided.",{"name":346,"text":347},"Replace old systems","Swap out devices and programs that no longer get updates in good time.",{"src":349},"/img/blog/photo-1550751827-4bd374c3f58b.webp",{},true,"/en/blog/cyber-resilience-act-september-2026-microsoft-smes-public-sector",{"title":53,"description":319},"en/3.blog/19.cyber-resilience-act-september-2026-microsoft-smes-public-sector","aQHBtW33FUKvSfqiWhIdqRbYixD5OgkHEE0D9NZEy9s",[357,362],{"title":358,"path":359,"stem":360,"description":361,"children":-1},"The EU AI Act for Small Businesses – Using AI at Work, Relaxed","/en/blog/eu-ai-act-microsoft-copilot-smes-august-2026","en/3.blog/18.eu-ai-act-microsoft-copilot-smes-august-2026","The EU AI Act sets rules for AI. What it means for Copilot, ChatGPT and friends in everyday office work and how to approach it calmly.",{"title":363,"path":364,"stem":365,"description":366,"children":-1},"Nextcloud for Small Businesses – Your Own Cloud, Simply Explained","/en/blog/nextcloud-for-smes","en/3.blog/2.nextcloud-for-smes","Files, calendar and contacts in one place – on a server you know. Here's how Nextcloud works for small businesses.",1792720367698]