Q&A CRA

The approach varies from case to case, and identity management must be agreed upon between parties. The birth certificate is not necessarily replaced by the first operational certificate; it can exist in parallel and be used again upon ownership transfer. Another option (depending on the scenario), for instance, when the transfer from Company A to Company B is due to a carve-out, Company B could trust the Operational CA for a while or even cross-sign a CA during the transition.

No, there is not. Any software provided as a service that does not support the functionality of a product with digital elements is outside the scope of the CRA. Recital 9a of the current proposal mentions that “Cloud solutions constitute remote data processing solutions within the meaning of this Regulation only if they meet its definition. For example, cloud-enabled functionalities provided by the manufacturer of smart home devices that enable users to control the device at a distance should fall within the scope of this Regulation. On the other hand, websites that do not support the functionality of a product with digital elements or cloud services designed and developed outside the responsibility of a manufacturer of a product with digital elements are not in the scope of this Regulation. Directive (EU) 2022/2555 [NIS2] applies to cloud computing services and cloud service models, such as Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS) or Infrastructure-as-a-Service (IaaS).” The Q&A issued by the European Commission in December 2023 also clarifies: “Will software, when provided as a service and not as a product, be covered under the CRA? Software provided as part of a service is not covered by the proposed Cyber Resilience Act, as it covers only products with digital elements sold within the European single market and sets out concrete cybersecurity requirements and obligations for the manufacturers of these products.” However, as mentioned in Recital 9a of the CRA, the NIS2 directive applies to software provided as a service, under which SaaS solutions might have specific obligations.  

No, no self-signed certificates. They are signed by a “proper” CA – the root can be Nexus or the customers’. Factory CA typically has a different certificate chain compared to the Operational CA, and quite often, it’s on-premise. However, it always follows a proper, well-defined CA hierarchy based on Nexus Certificate Management.