Cyber Resilience Act (CRA) – Frequently Asked Questions

September 11, 2026: Vulnerability reporting becomes mandatory

The Cyber Resilience Act (CRA) is an EU regulation that introduces cybersecurity requirements for products with digital elements. Its aim is to ensure that hardware and software products placed on the EU market are designed, developed, and maintained with cybersecurity in mind throughout their lifecycle.

Below you’ll find answers to some of the most common questions about the Cyber Resilience Act and what it means for DNWP products and customers.

If you have a question that isn’t covered here, please use the contact form at the bottom of this page to get in touch with us.

Which DNWP products are affected by the Cyber Resilience Act?

The EU Cyber Resilience Act (CRA) applies to nearly all hardware and software products with digital elements that connect directly or indirectly to a device or network.

DNWP Connection Master belongs to the CRA category Important Products – Class I.

How does DNWP ensure compliance with the Cyber Resilience Act?

DNWP actively monitors potential vulnerabilities in the software components it uses (CVEs), follows cybersecurity information published by Traficom, and performs security scans.

Users should also inform DNWP if they suspect a security vulnerability or exploitation.

How are security vulnerabilities handled?

If DNWP becomes aware of an actively exploited vulnerability affecting its product, DNWP will assess the vulnerability and report it in accordance with the CRA reporting requirements.

An actively exploited vulnerability is a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without the system owner’s permission.

What does the Cyber Resilience Act mean for DNWP customers?

There is no change to how customers operate their networks. DNWP has monitored and addressed vulnerabilities since before the CRA requirements came into effect.

The main new requirement is mandatory reporting of actively exploited vulnerabilities, starting on September 11, 2026.

If an actively exploited vulnerability affects a DNWP product, DNWP will also inform customers with active software maintenance directly.

What documentation is available to demonstrate CRA compliance?

The Security Advisor page in the Partner Portal lists known Connection Master vulnerabilities and recommended actions.

If you do not have access to the Partner Portal but are a DNWP customer and require access, please contact us at info@dnwpartners.com.

Have a question?

If you have a question that isn’t covered above, please use the form below to get in touch with us.