EU Cyber Resilience Act Annex I Part I(2)(d): Protection from unauthorised access and reporting of it

The product must protect against unauthorised access through appropriate control mechanisms, including authentication, identity or access management systems, and report on possible unauthorised access.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

What else in your programme already covers this

This control maps to 10 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ETSI EN 303 645 · 8 controls

Provision 5.1-1 Passwords unique per device or set by the user
Provision 5.1-2 Pre-installed unique passwords generated to resist automated attack
Provision 5.1-2A No passwords for machine-to-machine authentication
Provision 5.1-3 Best practice cryptography in authentication mechanisms
Provision 5.1-4 Simple way to change the authentication value
Provision 5.1-5 Brute-force attacks over network interfaces made impracticable
Provision 5.4-3 No hard-coded critical security parameters in source code
Provision 5.5-4 Network access to device functions only after authentication

IEC 62443 · 2 controls

CR 1.1 Human user identification and authentication
CR 2.1 Authorization enforcement

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

EU Cyber Resilience Act Annex I Part I(2)(d): Protection from unauthorised access and reporting of it

What else in your programme already covers this

ETSI EN 303 645 · 8 controls

IEC 62443 · 2 controls

Other controls in Annex I Part I essential cybersecurity requirements – EU Cyber Resilience Act

Query this from an agent