Following the harmonized standards for the Cyber Resilience Act means checking many sources: CEN-CENELEC project pages, ETSI work items and committee updates. The new CRA Standards Tracker brings them together on one page.
The tracker lists 32 standards and amendments: the horizontal EN 40000-1 series, the vertical standards for important products in Class I and Class II and for critical products, and the IEC 62443-based standards for industrial automation (OT). For each one, it shows:
- Its stage, from drafting through enquiry and approval to citation in the Official Journal, with a key explaining each stage
- The line it answers in the standardization request M/606
- Whether a citation in the Official Journal is expected, since only cited standards give a presumption of conformity
- A link to the project page at the standards body
A “Recent changes” section at the top shows what moved since the last check.
Where things stand
As of November 11, 2026, no CRA harmonized standard is cited in the Official Journal.
- EN 40000-1-1 (vocabulary) and EN 40000-1-2 (principles, risk management and lifecycle activities) were ratified on November 2, 2026, with publication planned for November.
- prEN 40000-1-3 (vulnerability handling) is in its formal vote.
- prEN 40000-1-4 (generic security requirements) is drafted, with publication planned for June 2027.
- ETSI has closed the enquiry and vote for six of its product standards, and most other vertical standards are in their approval step.
With the main CRA requirements applying from December 11, 2027, the coming months decide which standards manufacturers can rely on in time. I will update the tracker as the standards move; see the CRA Standards Tracker for the full table.
