ISO/IEC 27001 vs CRA — when to certify both

Many hardware teams arrive at compliance planning carrying an ISO/IEC 27001 certificate they earned for enterprise procurement and assume it covers their obligations under the EU Cyber Resilience Act. It does not — at least not on its own. ISO/IEC 27001 is an organisational management-system standard published jointly by ISO and IEC; the CRA is a product-safety regulation in the New Legislative Framework family, sitting alongside the Radio Equipment Directive, EMC, LVD and the Machinery Regulation.

This article walks through the structural differences, the genuine overlap in vulnerability handling, and the practical decision: when to pursue both, when to defer one, and how to make ISMS evidence reusable in a Notified Body assessment.

Two different objects of regulation

The first and most important distinction is structural.

ISO/IEC 27001 is described by ISO as a standard that "specifies requirements for establishing, implementing, maintaining and continually improving an information security management system". Certification is awarded by accredited registrars after a three-stage audit (Stage 1 documentation review, Stage 2 implementation audit, surveillance audits). It says nothing about whether your product meets any specific security property; it says your organisation manages risk to information assets in a systematic way.

The CRA, by contrast, is a product regulation. Article 13 places duties on the manufacturer to ensure products with digital elements "comply with essential cybersecurity requirements" in Annex I, prepare technical documentation, draw up an EU Declaration of Conformity, and affix the CE marking before placing the product on the market.

Inside ISO/IEC 27001:2022 — clauses and Annex A

The 2022 edition restructured Annex A significantly. The previous 2013 version had 114 controls across 14 domains. The current standard consolidates these into 93 controls organised into four themes:

The management-system requirements themselves sit in Clauses 4 to 10 of the main body: context of the organisation, leadership, planning (including risk assessment), support, operation, performance evaluation, and improvement. These clauses follow the harmonised ISO management-system structure also used by ISO 9001 and ISO 14001 — meaning a Statement of Applicability (SoA) is the bridge between Clause 6 risk treatment and the Annex A controls you actually deploy.

ISO/IEC 27002:2022 provides implementation guidance for each of the 93 controls but is not itself certifiable.

Inside the CRA — Annex I as the conformity target

The CRA's substantive product requirements live in Annex I, split into two parts.

Annex I Part I — Essential cybersecurity requirements (security properties). Products must be "designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks" and "delivered without any known exploitable vulnerabilities". The listed properties include secure default configuration, protection against unauthorised access, confidentiality and integrity of data, data minimisation, availability of essential functions, attack-surface reduction, exploitation mitigation, security monitoring, and a secure update mechanism.

Annex I Part II — Vulnerability handling requirements. Manufacturers must identify and document vulnerabilities and components (including a machine-readable SBOM), remediate without delay, conduct effective security testing, publicly disclose information about fixed vulnerabilities, operate a coordinated disclosure policy, facilitate vulnerability reporting via a single point of contact, distribute updates securely and "without delay and free of charge", and provide accompanying advisories.

Conformity is assessed via the modules in Annex VIII — predominantly Module A (self-assessment) for default products, Module B+C (EU-type examination) or H (full quality assurance) for important and critical products listed in Annex III/IV.

Where the two overlap — and where they don't

The genuine overlap is in vulnerability handling and secure development lifecycle. A mature ISMS audited under ISO/IEC 27001:2022 should already evidence:

• Coordinated vulnerability disclosure (Annex A.5.5, A.5.7) — maps to CRA Annex I Part II §5, §6.
• Information-security incident management (Annex A.5.24–A.5.28) — maps to CRA Article 14 incident reporting and Annex I Part II §3.
• Secure development lifecycle (Annex A.8.25–A.8.31) — supports CRA Annex I Part I "appropriate level of cybersecurity based on the risks".
• Supplier and third-party risk management (Annex A.5.19–A.5.23) — supports the CRA "due diligence" duty on integrated components.
• Configuration management and secure-by-default principles (Annex A.8.9, A.8.27).

Where the standards do not overlap:

• ISO/IEC 27001 says nothing about CE marking, the EU Declaration of Conformity, or notified-body involvement.
• ISO/IEC 27001 does not test product-level security properties — your ISMS audit will not verify whether the product is delivered "without any known exploitable vulnerabilities" or whether secure defaults are correctly implemented.
• ISO/IEC 27001 does not impose the CRA's 24-hour and 72-hour ENISA reporting timers for actively exploited vulnerabilities and severe incidents.
• ISO/IEC 27001 imposes no 10-year technical-file retention or 5-year minimum support period.

A Notified Body can accept ISMS evidence as partial substantiation of CRA Annex I Part II conformity — particularly for Modules B/C and H — but cannot waive product-level testing for Annex I Part I.

A practical decision matrix

Common mistakes

• Treating an ISO/IEC 27001 certificate as a CRA exemption. It is not. The CRA requires CE marking and an EU DoC against Annex I — independent of any ISMS certificate.
• Confusing ISO/IEC 27001 with ISO/IEC 62443 or EN 18031. Product-level cybersecurity standards (62443 for industrial automation, EN 18031 for radio equipment) are testable against products. ISO/IEC 27001 is not.
• Scoping the ISMS to exclude the product team. If product engineering and the secure-development lifecycle are outside the ISMS scope, you cannot reuse ISMS evidence for CRA conformity.
• Ignoring the SoA. Annex A controls in 27001:2022 are reference controls; the Statement of Applicability is what binds your specific ISMS to them. Notified Bodies will ask to see it.
• Assuming ISO/IEC 27001 covers ENISA reporting timers. It doesn't. The 24-hour early warning and 72-hour notification duties from 11 September 2026 are CRA-specific.

Using Cenitia for this work

Cenitia helps prepare evidence-linked working drafts within its supported regulatory catalogue. Confirm the product scope, actual applied standards and completed assessments, and review the result before issuance. Source-change alerts prompt a review; they do not certify conformity, automatically reissue a signed declaration or guarantee monitoring of every national rule and standard edition.

Related from the Library

• CRA Annex I — essential cybersecurity requirements explained — the product-level requirements ISO 27001 does not test.
• CRA vs NIS2 — where they overlap — a parallel comparison for organisations subject to both directives.
• CRA timeline and reporting obligations — the September 2026 and December 2027 dates that determine your runway.
• Conformity assessment modules A to H — how Notified Body involvement is determined.
• SBOM — CycloneDX vs SPDX for hardware — supporting the Annex I Part II SBOM requirement.

Further reading

• Regulation (EU) 2024/2847 — Cyber Resilience Act (EUR-Lex) — the official consolidated text.
• European Commission — Cyber Resilience Act policy page — Commission policy explanation and FAQs.
• ISO/IEC 27001:2022 (ISO Standards catalogue) — the canonical standard page.
• ISO/IEC 27002:2022 — implementation guidance for the 93 Annex A controls.
• ENISA — Cyber Resilience Act resources — single reporting platform guidance.
• CRA Annex I full text mirror — readable cross-reference for Annex I Parts I and II.
• Article 13 of the CRA — manufacturer obligations — the binding duty linking products to Annex I.