EU Cyber Resilience Act Annex I Part I(2)(e): Confidentiality of stored, transmitted and processed data

The product must protect the confidentiality of data it stores, transmits or otherwise processes, personal or other, for example by state of the art encryption at rest and in transit and other technical means.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

What else in your programme already covers this

This control maps to 8 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ETSI EN 303 645 · 6 controls

Provision 5.4-1 Sensitive security parameters stored securely in persistent storage
Provision 5.5-1 Best practice cryptography for secure communication
Provision 5.5-6 Critical security parameters encrypted in transit
Provision 5.5-7 Confidentiality of critical parameters over remotely accessible interfaces
Provision 5.8-1 Personal data in transit to associated services protected
Provision 5.8-2 Sensitive personal data in transit protected

IEC 62443 · 2 controls

CR 4.1 Information confidentiality
CR 4.3 Use of cryptography

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 8 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All EU Cyber Resilience Act controls

What else in your programme already covers this

ETSI EN 303 645 · 6 controls

IEC 62443 · 2 controls

Other controls in Annex I Part I essential cybersecurity requirements – EU Cyber Resilience Act

Query this from an agent