With full implementation scheduled for December 11, 2027, and severe penalties for non-compliance, manufacturers will have to demonstrate that cybersecurity is integrated into their products from design through implementation and lifecycle management. This means that all new designs should already have cybersecurity built in.
To meet these requirements, Arrow combines NXP's semiconductor and security expertise with the engineering capabilities of eInfochips, an Arrow company. By leveraging NXP's secure technologies through comprehensive security design and documentation, eInfochips can help streamline CRA-compliant development and reduce CRA compliance efforts.
The coordinated process encompasses everything from initial risk assessment to secure procurement, creating a structured and repeatable path to compliance.
The process at eInfochips begins with a joint risk analysis conducted with the end customer. This includes threat modeling and the definition of cybersecurity requirements aligned with IEC 62443-4-1. The result is a documented cybersecurity plan and a requirements framework that guides development activities throughout the product lifecycle.
eInfochips supports hardware design, firmware development, and the development of mobile and cloud applications, all with integrated cybersecurity throughout the product design stages. This includes threat modeling, risk assessment, secure coding, SAST, DAST, and PAN testing, and implementation in projects focused on compliance with IEC 62443, RED3.3, or CRA.
NXP's security technologies, including EdgeLock® Secure Enclave and EdgeLock Secure Elements and Secure Authenticators, provide hardware-based roots of trust, protect device credentials, safeguard sensitive data, and support secure lifecycle operations, with the secure enclave further reinforcing platform integrity. These security foundations help address CRA's essential requirements for device integrity, authentication, access control, certification, data protection, and update integrity.
Following development, Arrow provides secure provisioning at its main distribution center in Venlo, the Netherlands, establishing device identity and secure configuration, while ensuring CRA-aligned lifecycle security throughout the deployment. Leveraging EdgeLock 2GO for secure provisioning and credential management, Arrow enables the reliable injection of keys, certificates, and lifecycle credentials at scale, supporting CRA-relevant requirements for secure updates, monitoring, and vulnerability management.
“Regulatory frameworks like the EU Cyber Resilience Act are reshaping how connected products are developed and maintained,” explained Philipp Mai, Vice President of Engineering for EMEA at Arrow. “Through our collaboration with NXP and eInfochips, we help customers streamline risk analysis, secure design, and provisioning, providing a structured approach to cybersecurity across the entire product lifecycle and accelerating their path to CRA compliance.”.
“At NXP, we have a long history of secure engineering through design, which naturally aligns with the requirements now formalized in the EU Cyber Resilience Act,” said Alasdair Ross, Vice President of Secure Edge Identification at NXP Semiconductors. “Thanks to this long-term commitment, we were ready for the CRA from day one. We are proud to support customers with the secure architectures and lifecycle services they need to bring compliant, resilient, and reliable products to market.”.
