What Are the Differences Between ISO 27001 and the CRA?
Open LinkedIn, scroll through any security newsletter, or run a quick search for compliance software, and you’ll see the same pattern. ISO 27001 ads everywhere. Automated gap analysis tools, SaaS platforms promising certification in 90 days, audit-readiness dashboards, AI-driven policy generators. The category is mature, well-funded, and aggressively marketed.
Now try the same exercise for the Cyber Resilience Act. The results are thinner. A handful of consultancies, some legal explainers, very few productized services. The regulation is newer, the market hasn’t caught up, and the ad spend reflects that gap.
That imbalance creates a problem. Teams that have seen ISO 27001 marketing for years tend to assume their certification covers most of what the CRA requires, or that the work overlaps enough to make CRA compliance a light lift. It doesn’t, because the two address different things. This post explains what ISO 27001 actually covers, then walks through the six obligations the CRA adds on top.
A quick note on ISO’s history
ISO was founded in 1947 to coordinate international standards across borders. The original mission was practical, helping postwar industry agree on common specifications so goods, materials, and processes could move between countries without being re-engineered every time.
ISO/IEC 27001 arrived much later. Its direct ancestor was BS 7799, a British standard published in 1995 by the UK’s Department of Trade and Industry. The international version became ISO/IEC 27001 in 2005, was revised in 2013, and reached its current form in 2022.
Today it’s the global benchmark for information security management systems. Tens of thousands of organizations across every sector hold the certification, which is why the supporting market of tools, auditors, and consultancies has grown so visible.
What ISO 27001 actually covers
ISO 27001 is a management system standard. The scope is the organization, not any specific product the organization makes. The certification confirms that a company has built and maintains an Information Security Management System (ISMS) that meets the standard’s requirements.
The ISMS covers policies, risk assessment, asset inventories, access control, supplier security, incident management, and business continuity. Annex A lists 93 controls in the 2022 version, grouped into organizational, people, physical, and technological categories. ISO 27002 acts as the implementation guide for those controls.
Certification requires an external audit run in two stages, followed by periodic surveillance audits and a full recertification every three years. The process is quite rigorous and the outcome is respected in enterprise sales, procurement, and vendor due diligence.
One point worth being explicit about. ISO 27001 says nothing about whether your product is secure. It describes how your organization manages information security as a whole. A company can be ISO 27001 certified and still ship a product with hardcoded credentials, no update mechanism, and unmonitored third-party dependencies.
Where the CRA starts from a different place
The Cyber Resilience Act is a product regulation. It applies to products with digital elements placed on the EU market, which covers everything from connected consumer hardware to standalone software and embedded firmware. The obligation sits on the manufacturer, and the unit of compliance is the product, not the company.
The CRA assumes the product itself must be secure by design and secure by default. Good organizational practices help, but they don’t substitute for the technical and documentary requirements that apply to each product.
The CRA also doesn’t operate in isolation. For some categories of products, sector-specific cybersecurity rules apply on top, and the workload of reconciling them is often underestimated. Connected machinery is the clearest example, with both the new Machinery Regulation and the Cyber Resilience Act applying to the same machine at the same time. Something similar happens with internet-connected radio equipment under EN 18031, where RED cybersecurity requirements sit alongside the CRA. Two industry standards also cover parts of what the CRA demands at the product level: EN 303 645 for consumer IoT, and IEC 62443 for industrial automation and control systems.
The six gaps ISO 27001 doesn’t fill
These are the obligations the CRA introduces that ISO 27001 doesn’t cover, in the order they typically come up during a compliance assessment.
1. CE marking and EU Declaration of Conformity
The CRA brings products with digital elements into the standard EU conformity framework. Every product within scope must carry the CE marking, either on the device itself or on the website for pure software. Behind the mark sits a signed EU Declaration of Conformity, a formal document where the manufacturer states that the product meets the applicable requirements.
This is regulatory paperwork with legal weight. ISO 27001 has no equivalent, because organizational certification doesn’t grant any right to place a marking on a product.
2. Secure by design at the product level
The CRA requires that products be designed, developed, and produced according to a defined set of essential cybersecurity requirements. That includes a documented threat assessment for the specific product, a secure development lifecycle traceable to the product’s architecture, and evidence that known vulnerabilities are addressed before release.
ISO 27001’s risk management operates at the organizational level. It asks whether the company identifies and treats information security risks across its operations.
3. 24-hour and 72-hour vulnerability reporting to ENISA
Under the CRA, manufacturers must notify ENISA within 24 hours of becoming aware of an actively exploited vulnerability in their product, with a more detailed report due within 72 hours. The obligation extends to severe incidents affecting the security of the product. This reporting regime starts in September 2026, and the ENISA single reporting platform is being built to handle the volume.
ISO 27001 includes incident management, but it stays internal. The standard requires the organization to detect, respond to, and learn from incidents. It doesn’t impose external reporting deadlines to a specific EU authority, and it doesn’t carry the same legal exposure for missing them.
4. Software Bill of Materials
The CRA requires manufacturers to maintain a Software Bill of Materials, a machine-readable inventory of the components in their product, at minimum covering top-level dependencies. The SBOM must be kept current and made available to authorities on request.
ISO 27001 covers asset management and supplier security, but the granularity stops well short of what the CRA expects. An ISMS audit won’t ask for a CycloneDX or SPDX file. A CRA assessment will.
5. Declared support period
The CRA obliges manufacturers to define and publish a support period for each product, during which security updates must be provided. The default expectation is at least five years, or the expected product lifetime if shorter. The support period must be communicated to buyers before purchase and respected throughout.
6. Post-market surveillance
The CRA establishes a post-market surveillance regime modeled on the broader EU product safety framework.
Manufacturers must monitor their products in the field, cooperate with market surveillance authorities, and act on findings. In serious cases, that can include corrective actions or product recalls.
ISO 27001 is a solid starting point. If your company already holds it, CRA compliance will be a much shorter project, particularly around documentation, supplier oversight, and incident handling.
The CRA shifts the question from “does your company manage security well” to “is this specific product compliant”, and it adds six obligations that no information security standard covers. ISO 27001 gets you most of the way on governance, but the product-level work has to be done separately.
If you want to map what your organization already has against what the CRA requires for your specific product, get a quoteand we’ll walk through it together.
