Digital Product Assurance and Cyber Security: Key Updates on EU, UK, and Global Regulations and Standards

It's an exciting world for digital product developers. 

Adopting technology into our everyday lives is a trend that is gathering pace and introducing major opportunities for products and services. However, this rapid consumption of digital products presents very real security impacts. As the CEO of the UK National Cyber Security Centre, Richard Horne, recently warned, "We face enduring threats from hostile states and cyber criminals looking to exploit our dependency on the technology that now underpins all aspects of modern life."

Across the UK and Europe, governments, regulatory agencies, and industry bodies are responding to this new threat landscape by working to improve digital products' cyber resilience. These include:

• Industry bodies such as the Global System for Mobile Communications Association (GSMA) and Chartered Institute of Information Security (CIISec), as well as professional organizations like the UK Cyber Security Council (UKCSC);
• Government departments like the Department for Science, Innovation and Technology (DSIT) and bodies such as NCSC and the National Protective Security Authority (NPSA);
• Multinational and regulatory agencies like the EU Agency for Cyber Security (ENISA).

In addition to the product-specific legislation focus, it is worth noting early that 'organizational compliance' mandates are coming into force to look at the security and resilience of supply chains and technologies associated with the operation of critical industries. Increasingly, it is apparent that the Utilities, Banking, and Transport sectors depend on third-party devices (such as payment terminals, ATMs, ticket machines, and so on), creating a 'flow-down' of requirements. 

Examples include:

• The Digital Operational Resilience Act (DORA)
• Network and Information System Directive 2 (NIS2).

This creates a complex assurance landscape for developers that demands integrating security best practices from the outset. Staying current with evolving standards and adhering to them is essential for safeguarding digital products from exploitation, ensuring long-term security, and maintaining market access.

What products are included?

The most detailed list is within the EU's Cyber Resilience Act (CRA), which defines them as 'Products with Digital Elements' (PDEs), and the scope here is vast. It ranges broadly from 'Default' class products, such as smart home devices to increasingly critical classes that include routers, operating systems, industrial IoT systems, VPNs, and firewalls.

Broadly speaking, this mirrors the UK's Cyber Resilience Testing (CRT) scheme definitions - 'commodity technology products' versus 'commodity technology whose primary purpose is the delivery of Cyber Security services to others'.

Specific legislation targets categories such as AI or radio-connected devices, while several specialist areas (such as medical devices, transport, or defense) will have bespoke assurance requirements.

What is changing?

Assurance requirements are being published by the groups mentioned above, with a steady focus on improving the security baseline for products before they enter the market and throughout their lifecycle.

At a minimum, self-assessment against these standards is required to enforce responsibility against manufacturers, whereas higher tier/class devices will require third-party validation by approved test labs such as an ISO/IEC 17025:2017 UKAS accredited NCC Group's LabUK function. 

While the volume of incoming rules may seem daunting, the good news is that there are broad areas of overlap between them. A holistic view of an organization's obligations will reveal numerous repetitions of basic best practice requirements, whether undertaking threat modeling or recommendations around passwords and encryption. 

The good work currently being done can, if properly marshaled and directed, be used as evidence to support multiple compliance regulations and assurances simultaneously.