Module H under the CRA: BSI TR-03183-H builds full quality assurance on ISO/IEC 27001

Two ways to involve a notified body

For products that need third-party conformity assessment, the Cyber Resilience Act offers procedures that look at different things. Module B+C has a notified body examine the product type (EU-type examination) and the manufacturer ensure conformity to that type. Module H (Annex VIII, full quality assurance) has the notified body approve and audit the manufacturer's quality system for design, development, final product inspection and testing, and vulnerability handling over the support period.

What TR-03183-H does

The BSI guideline describes one way to demonstrate conformity through Module H using an ISO/IEC 27001 information security management system. It is not a new management system standard. It:

• refines and adds to the requirements of ISO/IEC 27001 (clauses 4 to 10 apply unchanged where it says nothing), for instance on interested parties — the manufacturer and the third parties affected by the product's cybersecurity risks — scope, risk assessment and treatment, change planning and documented information;
• gives CRA-specific guidance on ISO/IEC 27002 controls such as threat intelligence, technical vulnerabilities, the secure development lifecycle, security testing and change management;
• adds elements of ISO 9001 quality management where Module H needs them, because a QMS alone does not anticipate changing a product after it is placed on the market, and an ISMS alone does not cover product quality assurance.

The ISMS covers both business services: placing products with digital elements on the market and providing the remote data processing that belongs to them. Updates and other measures from vulnerability handling count as changes and go through the design, development and production process.

Standards inside the quality system

The guideline calls harmonized standards and common specifications cited for presumption of conformity "conformance specifications". They are to be used to interpret, implement and assess the essential requirements; deviating needs a justification based on the risks, intended purpose, conditions of use and expected time in use. Where none exists, sector standards and best practice apply. TR-03183-1 is expressly not a conformance specification; it can serve as guidance without a conformity claim.

Benefits and risks

Because the certificate covers the quality system, one approval can cover a whole category of products and frequent updates without a new type examination each time; certification typically runs in three-year cycles with annual surveillance audits. The risk is the reverse: if the certificate is lost, conformity of everything produced under it is at stake, and products made without a valid certificate generally cannot regain it. Changes to the quality system have to be notified to the notified body and may trigger a reassessment.

Not a pure process certificate under the CRA

Under the CRA, Module H includes a review of the technical documentation for one model of each product category and an auditing team with at least one assessor experienced in the product field. Module B+C, in turn, comes with regular audits of the vulnerability handling requirements. The guideline concludes that the two are less distinct under the CRA than in other EU legislation. Choosing a module never replaces meeting the essential requirements.