Skip to main content

Annex I, Part II, Req 3: Effective and Regular Software Security Testing

You can't fix what you don't know is broken. The EU Cyber Resilience Act (CRA) mandates proactive security validation: manufacturers shall "apply effective and regular tests and reviews of the security of the product with digital elements" (Annex I, Part II, Point 3).

What "Effective and Regular" Means​

  1. Effective Testing: Your testing methods should be capable of actually finding relevant security weaknesses in your software (game, app, component). This could include:
    • Vulnerability Scanning: Using automated tools to check for known vulnerability patterns.
    • Penetration Testing: Simulating attacks to identify exploitable flaws.
    • Code Reviews: Manual or automated analysis of source code for security bugs.
    • Fuzz Testing: Sending malformed or unexpected data to inputs to find crashes or unintended behavior.
    • Security Regression Testing: Ensuring that new changes haven't reintroduced old vulnerabilities or created new ones.
  2. Regular Testing: Security testing shouldn't be a one-time event before release. It needs to be an ongoing activity throughout the software development lifecycle and the product's support period.
    • During Development: Integrate security testing into your CI/CD pipeline.
    • Before Major Releases/Updates: Conduct thorough testing.
    • Periodically Post-Release: Especially if new threat intelligence emerges or significant changes are made to components.

Scope of Testing​

The testing should cover your "product with digital elements." This includes:

  • Your application code.
  • Interactions with backend services you manage.
  • How your software handles data.
  • The security of its interfaces and APIs.

Risk-Based Approach​

The frequency and depth of testing should be guided by your overall cybersecurity risk assessment (Article 13, Paragraph 2) and the nature of your software. Higher-risk software will warrant more intensive and frequent testing.

Key Takeway​

Under Annex I, Part II, Point 3 of the CRA, you must regularly and effectively test the security of your software. This is an ongoing process using various methods like penetration testing and code reviews to proactively find and fix vulnerabilities.