Cyber Resilience Act, Part 2: Security by Design becomes mandatory

Cyber Resilience Act, Part 2: Security by Design becomes mandatory Feature articles | July 30, 2026 By Alexander NeumannCyber Resilience Act: Security must be built into architecture, hardware, and software from day one – especially for embedded and IoT development. This part focuses on why “Security by Design” and “Secure by Default” will become mandatory, and what this specifically means for embedded and IoT developers. Core elements of Security by Design are:Early integration: Security requirements are incorporated into requirements, architecture, and design from the outset. Secure by Default: Safe factory settings are expectedIn addition to Security by Design, the CRA also mandates Secure by Default. Security requirements affect architectural decisions just as they do supply chains, maintenance models, and documentation processes.