Why Cyber Resilience Act Compliance Is Really a Data Problem

Compliance depends on the ability to connect the product lifecycle

In the first part of this series, I described the European Union's Cyber Resilience Act as more than a cybersecurity requirement. It is a product-lifecycle and market-access regulation. That distinction matters, because it changes who in the organization owns the problem and what it takes to solve it.

The CRA requires manufacturers to design products securely, manage vulnerabilities throughout the support period, maintain evidence, complete conformity assessment, and respond quickly when a vulnerability is exploited or a severe incident occurs. Reporting obligations took effect on September 11, 2026, and the main product obligations apply after December 11, 2027 European Commission – Cyber Resilience Act. That timeline is no longer theoretical. It is live.

For many companies, the core difficulty will not be understanding the individual requirements. The greater challenge will be connecting the many moving parts needed to execute them consistently. This is where PTC can help.

PTC provides digital-thread capabilities that help companies manage the product information, workflows, traceability, changes, and lifecycle records upon which effective Cyber Resilience Act compliance depends. By connecting components, the digital thread can reduce the effort required to assemble evidence and respond to product-security issues.

This challenge is not unique to PTC's customer base. A 2024 ENISA threat landscape analysis found that vulnerability exploitation nearly tripled as an initial attack vector year over year, underscoring why regulators are pushing manufacturers toward faster, more precise vulnerability response ENISA Threat Landscape 2024. Speed and traceability are no longer optional disciplines—they are the baseline.

How PTC can help companies become CRA-ready?

Codebeamer: Connect requirements, risks, tests, and evidence

For CRA programs, that supports the ability to:

• Translate regulatory and cybersecurity expectations into controlled requirements
• Connect requirements to risks, architecture, tests, defects, and corrective actions
• Establish reusable secure-development workflows
• Demonstrate verification and validation coverage
• Perform impact analysis when a requirement, component, or risk changes
• Maintain change history, reviews, approvals, and baselines
• Produce evidence showing how each requirement was addressed

The value is that once qualified experts define the applicable requirements, Codebeamer helps teams manage their execution and demonstrate the relationship between the obligations and the engineering evidence. This same capability applies not only to the CRA but to all product and regulatory requirements, whether software, electrical, or mechanical.

Windchill: Govern the product and its compliance evidence

Windchill serves as the governed, master product-data foundation for CRA-related work.

That foundation helps manufacturers:

• Identify the exact product configuration being assessed
• Connect hardware and software configuration information
• Govern bills of material and related product records
• Associate cybersecurity requirements and evidence with affected products
• Control changes to designs, components, documentation, and releases
• Preserve revision history, approvals, and baselines over long product lifecycles
• Provide a consistent product definition across the organization

This matters because CRA evidence is not credible if it is disconnected from the product configuration to which it applies. A risk assessment, test result, or SBOM has limited value if the organization cannot determine which product version, variant, or release it describes. Windchill is the master record for the governed product definition, and the other capabilities below connect to it.

Creo: Maintain the integrity of the product definition

Creo supports the CRA digital thread by providing the detailed engineering definition of the physical product. When integrated with Windchill, it ensures engineering data remains aligned with the governed product configuration. This alignment is critical for connected products, where cybersecurity-related changes often affect the broader product definition and must be managed consistently across engineering, manufacturing, and service processes.

Arbortext: Produce the service and technical information that supports field campaigns and recalls

When a vulnerability or non-compliance triggers corrective action in the field, technicians and customers need accurate, up-to-date instructions fast. Arbortext generates dynamic, source-connected technical and service information directly from the governed product data. Because the content is linked to the product configuration and change records, service instructions, update procedures, and safety notices can be produced and revised quickly and consistently to support field campaigns and recalls. This closes a frequently overlooked gap: the correction may be engineered, but the campaign cannot execute until the people performing it have correct, configuration-specific instructions. Arbortext helps ensure that the service materials match exactly the affected products and releases.

ServiceMax and Orbit: Connect corrective action to the field

CRA obligations continue after a product enters the EU market. Manufacturers must manage vulnerabilities and deliver appropriate security updates during the support period.

Relevant use cases include:

• Identifying affected installed products or product populations
• Coordinating field actions and work order
• Recording service activity and asset history
• Capturing customer or field issues
• Tracking execution of corrective actions
• Feeding field observations back to quality and engineering

CRA precision depends not only on the As-Designed and As-Built definition, but on knowing the As-Maintained state of products in the field—what has actually been serviced, updated, or replaced over time. PTC Orbit helps maintain a connected As-Maintained record of installed products, capturing the real configuration of each asset as it evolves in service. Windchill remains the master record for the governed product definition; Orbit complements it by reflecting how individual units have changed after delivery. Together, they let a manufacturer answer with confidence about which specific units are affected by a given vulnerability, dramatically narrowing the scope of a campaign or recall.

This kind of precision has real financial weight behind it. The average cost of a data breach reached $4.88 million globally in 2024, and the same research found that organizations with extensive security AI and automation identified and contained breaches significantly faster than those without IBM Cost of a Data Breach Report 2024. Narrowing the scope of a field campaign is not just an operational convenience, it is a direct lever on cost and exposure.

How PTC can help avoid compliance issues

The best response to a CRA issue is to prevent it from ever reaching the market. The same connected digital thread that makes a company CRA-ready, with each PTC solution playing the role described above, is also what keeps compliance gaps from forming in the first place. Because PTC's Intelligent Product Lifecycle solutions make that thread AI-ready, prevention becomes a repeatable, auditable part of everyday product development rather than a scramble ahead of each audit or release. A few disciplines do most of the work.

Make cybersecurity requirements part of product development

When security requirements are managed and traced alongside functional, quality, safety, and other regulatory requirements—and tied to the governed product definition rather than tracked on the side—gaps become visible early. A missing requirement, incomplete verification, or an unapproved change surfaces before a product ships instead of during an audit.

Strengthen change control

A product can become non-compliant when change management and cybersecurity are treated as separate processes. Embedding cybersecurity review within the governed change process helps ensure that conformity is maintained as the product evolves, using the same connected product data and traceability already relied on for engineering decisions. Rather than being checked after the fact, compliance becomes part of how changes are evaluated and implemented.

Improve software-component visibility

Knowing exactly what is inside each product is what lets a manufacturer tell, quickly, whether a newly disclosed vulnerability applies. This is not a hypothetical concern: the 2024 Open Source Security and Risk Analysis report found that 86% of commercial codebases contained at least one known open-source vulnerability Synopsys OSSRA 2024.

By connecting governed configuration and SBOM data with the broader cybersecurity ecosystem, organizations can maintain an accurate view of product risk while preserving traceability across the product lifecycle. Security findings are linked back to the requirements, changes, tests, releases, and service activities that shape the product, providing the context needed to assess impact and drive remediation. PTC serves as the foundation for that connected approach.

Replace manual evidence reconstruction with traceability

Organizations that still prove compliance with Word documents, spreadsheets, email approvals, and hand-built trace matrices rebuild the same evidence for every audit and release.

Each step in the product lifecycle should be easy to identify seamlessly, rather than a separate project each time.

How PTC can support rapid response to compliance issues

The CRA's reporting timeline makes response speed a strategic capability. An early warning may be required within 24 hours, followed by a fuller notification within 72 hours and a later final report. Industry benchmarks show why that window is so demanding: the 2024 Verizon Data Breach Investigations Report found that the median time for organizations to remediate critical vulnerabilities, once detected, stretched to 55 days, while attackers frequently exploit new vulnerabilities within days of disclosure Verizon 2024 DBIR. A 24-hour reporting clock leaves no room for manual reconstruction of product records.

To respond effectively, companies need to answer several questions quickly:

• Which products contain the affected software or part?
• Which versions and configurations are affected?
• Which products were placed on the EU market?
• Which customers or installed assets are affected, in their current As-Maintained state?
• What security requirements and tests apply?
• What changes are needed, and what documentation must be updated?
• How will the correction be verified, released, and deployed?

A connected PTC environment shortens the path to those answers.

Step 1: Determine the products impacted

Drawing on the governed product and change context, teams can pinpoint exactly which units are in scope far faster than searching across isolated repositories. That precision reduces campaign scope, cost, and customer disruption.

Step 2: Design and develop the solution

The corrective work is managed as a single, traceable process that maintains continuity from issue identification through implementation and verification. By keeping activities connected within the product lifecycle, organizations can coordinate cybersecurity, engineering, quality, and service efforts without creating disconnected workflows or gaps in accountability.

Step 3: Validate the solution

The fix must be shown to reduce risk without introducing new issues. Because verification and approval remain connected to the work throughout the process, the evidence needed to demonstrate compliance is created as part of the response itself. Rather than being assembled after the fact, it is captured naturally as changes are evaluated, implemented, and validated.

Step 4: Deploy and document

Where a field visit is required, the field-facing tools each do the job established earlier: Arbortext produces the configuration-specific service instructions for the affected products, ServiceMax schedules, dispatches, and records the work, and Orbit updates the As-Maintained record once the fix is applied. Product and compliance records then both reflect the service lifecycle accurately.

For regulatory notification, PTC technologies help organize and retrieve the supporting product evidence manufacturers need for the designated CRA reporting process, improving the flow of accurate product and service information into the reporting workflow.

The time to connect the lifecycle is now

The first major CRA operational deadline took effect on September 11, 2026. Full application follows on December 11, 2027 European Commission – Cyber Resilience Act. Executives should be asking:

• Do we know which of our products are in scope?
• Can we trace security requirements to risks, designs, software, tests, releases, and evidence?
• Can we identify every product affected by a vulnerable component—in its true, current configuration—within hours?
• Can we control and verify the resulting corrective actions?
• Can we reach affected products and customers during the support period?
• Can we produce defensible evidence without reconstructing it by hand?

If the answer to any of these questions is uncertain, the organization has more than a regulatory issue. It has a product-lifecycle visibility issue.

From compliance burden to faster, more efficient product development

CRA readiness will require investment. But the digital capabilities needed to support it generate value well beyond CRA regulatory compliance. The digital thread or connected data foundation delivered by PTC's Intelligent Product Lifecycle solutions will also improve the speed, cost, and quality of your product development process.

This is why I do not view the CRA solely as a compliance deadline. It is an opportunity to transform product development. Companies that respond by creating more spreadsheets and adding manual reviews may satisfy individual requests, but they will also add cost and delay.

That same connected foundation makes lifecycle data AI ready.

Connecting that thread is not a project you start the week before an audit. It starts with a conversation.

Will you still have access to the EU market next year?

The EU Cyber Resilience Act makes cybersecurity a condition of market access. Learn what the CRA covers, who it affects, and how to comply before 2027.

Read Now

Why MedTech manufacturers should pay attention to the CRA

Cybersecurity is becoming essential to market access. Learn how it will affect MedTech manufacturers.

Read Now