The EU Cyber Resilience Act (CRA) is a regulation (EU 2024/2847) that defines mandatory cybersecurity requirements for all products with digital elements sold in EU markets. Reporting obligations began on Sept. 11, with full enforcement commencing on Dec. 11, 2027. The CRA sets new requirements for teams working with containers and Kubernetes that impact how cloud native applications are built, distributed, and maintained throughout their lifecycle.
Cloud native scope and who is affected
Regardless of where a distributing organization is located, the CRA covers all container images, Kubernetes operators, and Helm charts with commercial support that are available to EU customers. The regulation specifies its scope as "products with digital elements" available in EU markets, and that also includes a lot of the cloud native stack. CRA scope covers container images distributed publicly, commercial Kubernetes operators, open source with commercial backing, and Helm charts with commercial support. Open-source projects may also be impacted, including those with commercial backing or support contracts. In addition, the regulation requires a compliance chain throughout the cloud native supply chain.
Requirements for container teams
The CRA introduces requirements that directly impact how teams build and operate container infrastructure. These categories include vulnerability management, security by design and default, and long-term security obligations.
Vulnerability management
As a result of the CRA, organizations must maintain Software Bill of Materials (SBOM) data, continuously monitor for vulnerabilities, and remediate within defined timeframes. Under the Act's Article 14, actively exploited vulnerabilities must result in an early warning to The European Union Agency for Cybersecurity — maintaining the acronym from the agency's previous name European Network and Information Security Agency — ENISA — within 24 hours of discovery, followed by a full notification within 72 hours. This mandates that organizations' detection and incident response processes need to operate at scale across clusters.
Security by design and default
The regulation orders what many in the cloud native community have long wanted — now minimal attack surfaces and secure defaults are regulatory requirements rather than recommendations. This Act specifies that base images must be hardened with unnecessary components eliminated and secure configurations applied before products are made available on the market.
Long-term security commitments
Now products require security updates for a minimum of five years from the date of being available on the market, or throughout the expected product lifetime if that period is shorter, as stated in Article 13 of the CRA. For container teams, this requires tracking container versions deployed in customer environments, ensuring backward compatibility, and maintaining rebuild pipelines for older images — all while addressing security issues discovered years after release.