7 Software Supplier Red Flags for CRA and NIS2 Compliance

In an increasingly interconnected digital world, cyberattacks pose a constant threat. The European Union has responded with two pioneering regulatory frameworks: the Cyber Resilience Act (CRA) and the NIS2 Directive. For IT managers and procurement, it is now more crucial than ever not only to protect their own systems but also to ensure the cyber resilience of the entire supply chain. Your software suppliers play a central role in this. But how do you recognize whether a provider truly meets the new requirements and isn't just making empty promises?

This article highlights the most important red flags you need to watch out for when selecting and evaluating your software suppliers to avoid compliance risks and potential security vulnerabilities.

CRA and NIS2: The New Rules in Cyberspace

The Cyber Resilience Act (CRA) is an EU regulation that came into force on December 11, 2024. For the first time, it establishes uniform cybersecurity requirements across Europe for products with digital elements throughout their entire lifecycle. The goal is to enhance cybersecurity within the EU internal market and reduce vulnerabilities. The CRA applies to all digital products made available on the EU market – regardless of their development or company location, and whether they are free or paid (if commercially intended).

 

Affected are: Manufacturers, importers, and distributors of hardware (e.g., routers, smartphones) and software (e.g., operating systems, apps, B2B systems).
Key obligations for manufacturers (and thus your suppliers):

• Security by Design & Default: Security must be integrated into development and the product from the outset.
• Risk Assessment: Conduct and document cybersecurity risk assessments.
• SBOM (Software Bill of Materials): Comprehensive documentation of all software components and dependencies.
• Vulnerability Management: Systematic identification, remediation, and provision of security updates for at least five years.
• Reporting Obligations: Prompt reporting of vulnerabilities and security incidents to authorities (from September 2026).
• Declaration of Conformity & CE Marking: After successful conformity assessment.

 

Consequences of non-compliance: High fines (up to 15 million Euros or 2.5% of annual turnover), product bans, recalls, and reputational damage.

 

The NIS2 Directive, on the other hand, which has been transposed into national law in Austria since October 2024 (not yet fully in Germany, as of February 2026), focuses on organizational cybersecurity in critical and important sectors. It obliges companies to implement comprehensive security measures and incident reporting. NIS2 distinguishes between "essential entities" (e.g., in sectors such as energy, transport, banking, healthcare, digital infrastructure) and "important entities" (e.g., in postal and waste management, food production, as well as manufacturers of critical products like medical devices, computers, electronics, optical products, electrical equipment, mechanical engineering, motor vehicles and parts, automotive industry, and other transport equipment). Generally, medium and large enterprises in these sectors are affected; smaller companies may also fall under its scope in exceptional cases if their services are particularly critical for society.

Seven Red Flags for Software Suppliers: What IT Management and Procurement Need to Know

In light of the CRA and the NIS 2 Directive, it is essential to conduct a thorough review of suppliers. Here are the key warning signs:

1. Red Flag 1: Lack of transparency regarding place of manufacture and execution

   1. Why a Red Flag: Unclear information on development and server locations (e.g., outside the EU) carries geopolitical risks and data sovereignty issues (local laws). This can jeopardize your NIS2 compliance and complicate the traceability of CRA conformity.
   2. Your Questions: Where exactly is the software developed and operated? Which cloud providers and regions do you use?

2. Red Flag 2: Missing or inadequate product and component documentation

   1. Why a Red Flag: The CRA requires a Software Bill of Materials (SBOM). Without this comprehensive documentation, you cannot identify vulnerabilities in third-party components, your risk assessment will be insufficient, and you potentially violate CRA obligations.
   2. Your Questions: Can you provide a current SBOM in a machine-readable format? How do you ensure its up-to-dateness?

3. Red Flag 3: Incomplete vulnerability management and insufficient update capability

   1. Why a Red Flag: The CRA demands systematic vulnerability management and the provision of free security updates for at least five years. If clear processes or commitments are missing, the software quickly becomes a security risk and undermines your own NIS2 obligations.
   2. Your Questions: How does your vulnerability management process work? How long will the product version be supported with security updates?

4. Red Flag 4: Ignorance or trivialization of their own CRA/NIS2 obligations

   1. Why a Red Flag: A supplier who does not understand the relevance of CRA/NIS2 for their products or processes signals a lack of risk awareness and missing compliance strategies. An incorrect assessment of the product category can prevent important checks.
   2. Your Questions: How does your company ensure compliance with CRA and NIS2? Have internal processes been adapted accordingly (e.g., Security by Design)?

5. Red Flag 5: No clear commitment to support and update cycles

   1. Why a Red Flag: The CRA requires at least five years of security updates. Without a clear contractual commitment for support periods, you lack planning and investment certainty. This can lead to costly migrations or the operation of insecure software.
   2. Your Questions: What is the guaranteed support period for security updates? How are end-of-life phases communicated?

6. Red Flag 6: Missing security certifications or unwillingness to be audited

   1. Why a Red Flag: Especially for higher CRA product categories, external conformity assessments or certifications are mandatory. A refusal to provide this evidence or allow audits indicates insufficient checks or inadequate security.
   2. Your Questions: Which conformity assessment procedures have been completed? Can you provide certificates or audit reports?

7. Red Flag 7: Vague or insufficient incident response plans

   1. Why a Red Flag: CRA (reporting obligations from 2026) and NIS2 require quick and precise reporting of security incidents. A supplier must have a clear plan on how they will inform you as a customer and relevant authorities in a timely manner to enable you to meet your own reporting obligations.
   2. Your Questions: Do you have an incident response plan? How and when will you inform us about security incidents?

Recommendations for Action for Procurement and IT Management

• Contract Design: Integrate explicit CRA and NIS2 clauses (SBOMs, update cycles, incident response) into contracts.
• Due Diligence: Thoroughly check potential and existing suppliers against CRA/NIS2 checklists.
• Demand Transparency: Insist on open communication about security architecture, development, and locations.
• Audits: Plan (if contractually possible) regular security audits or request audit reports.
• Internal Training: Train your teams on CRA and NIS2 to better assess supply chain risks. 

Conclusion

CRA and NIS2 are ringing in a new era of cybersecurity. For IT managers and procurement, it is a shared task to critically review the compliance of software suppliers. Proactive action and careful consideration of red flags are crucial to meet the high security requirements and comprehensively protect your company. Those who pay attention to these warning signs today will secure their company's digital future.