General
The present document specifies technical requirements and corresponding assessment criteria for software products
with digital elements that detect or search for malicious software or code on a device, or remove or quarantine such
software or code to prevent or mitigate system infection related to cybersecurity. The products with digital elements in
scope, thereafter "the product":
• are specified within the "technical description" of the "category of product" number "4" by the Commission
Implementing Regulation (EU) 2025/2392 [i.2] as: -
"Software products with digital elements, typically referred to as antivirus or antimalware, that detect or
search for malicious software or code on devices, or remove or quarantine such software or code, in
order to maintain the integrity, confidentiality, or availability of such devices.
In the context of this category of products, malicious software means software containing malicious
features or capabilities that can cause harm directly or indirectly to the user and/or the computer system,
such as viruses, worms, ransomware, spyware and trojans.
This category includes but is not limited to software that detects or searches for malicious software in
real-time or manually, rootkit detection and rescue disks with the core functionality of searching,
removing or quarantining malicious software."
• are only covered within the product context described in clause 4.
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the
Regulation (EU) 2024/2847 [i.1], Annex I, Part I under the conditions identified in Annex A.
The present document specifies technical characteristics and methods of assessment for Antivirus/Antimalware
products.
The present document specifies technical requirements and corresponding assessment criteria for personal wearable
products that have a health monitoring purpose or that are intended for the use by and for children, related to
cybersecurity. The products with digital elements in scope, thereafter "personal wearable":
• are specified within the "technical description" of the "category of product" number "19" by the Commission
Implementing Regulation (EU) 2025/2392 of 28 November 2025 [i.2] as:
"Personal wearable products to be worn or placed on a human body that have a health monitoring (such as
tracking) purpose and to which Regulation (EU) 2017/745(2)or (EU) 2017/746 of the European Parliament
and of the Council do not apply, or personal wearable products that are intended for the use by and for
children".
• are only covered within the product context described in clause 4.
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the
Regulation (EU) 2024/2847 [i.1] Annex I Part I under the conditions identified in Annex A.
The present document specifies technical requirements and corresponding assessment criteria for public key
infrastructure and digital certificate issuance software related to cybersecurity. The products with digital elements in
scope, thereafter "the Products":
• are specified within the "technical description" of the "category of product" number "9" by the Commission
Implementing Regulation (EU) 2025/2392 [i.2] as:
"Products with digital elements used as part of a public key infrastructure (PKI) that manage the validation,
creation, issuance, distribution, status publication, renewal or revocation of digital certificates, or the
generation, storage, escrow, exchange, destruction or rotation of cryptographic keys associated with such
digital certificates. This category includes but is not limited to key management systems, digital certificate
management systems, online certificate status protocol responders and all-in-one PKI solutions".
• are only covered within the product context described in clause 4.
The present document covers those Products to demonstrate compliance with essential cybersecurity requirements in
the Regulation (EU) 2024/2847 [i.1] Annex I Part I under the conditions identified in annex A.
Different use cases representing different product architecture are presented in clause 4.6. Requirements applicability in
clause 5 then defines which requirements apply to which use case to ensure compliance with the CRA's essential
cybersecurity requirements.
The present document specifies technical requirements and corresponding assessment criteria for physical and virtual
network interfaces related to cybersecurity. The products with digital elements in scope, thereafter "network interfaces":
• are specified within the "technical description" of the "category of product" number "10" by the Commission
Implementing Regulation (EU) 2025/2392 [i.2] as:
"Physical network interfaces are products with digital elements that directly connect a device to a network via
an Application Programming Interface (API) provided by the interface drivers, typically operating at the data
link layer, and that feature hardware adapters to transmission media with corresponding firmware, typically
operating at the physical and data link layer.
Virtual network interfaces are products with digital elements that directly or indirectly connect a device to a
network via an API that emulates that of drivers of physical network interfaces, typically operating at the data
link layer.
This category includes but is not limited to wired and wireless network interface cards, controllers and
adapters, such as for Wi-Fi®, Ethernet, IrDA, USB, Bluetooth, NearLink, Zigbee®, or Fieldbus, as well as
purely virtual standalone products, such as virtual network interface cards, container network interfaces and
VPN interfaces".
• are only covered within the product context described in clause 4.
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the
Regulation (EU) 2024/2847 [i.1], Annex I Part I under the conditions identified in Annex A.
Network interfaces intended for use in the industrial Operational Technology (OT) domain are excluded from the scope
of the present document, see prEN 50770 series [i.5].
Network interfaces whose intended purpose includes management or configuration of the product over the attached
network are excluded from the present document.
Network interfaces whose intended purpose includes routing, switching; or transfer of information from one attached
network to a different attached network are excluded from the present document.