New Law Demands Five Years Of Security Patches

Tougher rules mean digital device and software manufacturers will have to report security breaches more quickly. They'll also have to offer security patches for at least five years.

The rules come from the European Union. They technically only cover products sold in EU member countries, though in many such cases manufacturers change their behavior worldwide to comply with the rules. The financial penalties for breaking the rules take into account global turnover.

The rules, which will become the Cyber Resilience Act, cover "products with digital elements." These include smart and connected devices, plus software with a security element such as a password manager, virtual private network or antivirus tools. (Source: insideprivacy.com)

Automatic Patches Required

The final version of the law will specify which products come under the rules. It will also designate some as being "important" or "critical", which will determine the precise requirements. The rules don't apply to any open-source software that is produced outside of any commercial activity.

Manufacturers and developers will need to build cyber security into the products from the beginning, including assessing the potential risks, and fully document security processes. They'll also have to issue security patches for five years and allow for automatic updates. This must be separate from any updates that fix performance issues or add new features.

They'll also need to tell national cyber security authorities about any breach within 24 hours of discovering it. For more severe breaches they'll need to tell users of the device or software.

The rules also mean anyone who imports products with digital elements from outside the EU will need to take adequate steps to make sure it is secure.

Hefty Penalties

The maximum penalty for a breach is €15 million or 2.5 percent of global revenue for the year, whichever is higher. (Source: theregister.com)

While the rules have been under discussion since September last year, members of the European Parliament have now completed negotiations with the relevant departments of national governments. It will require a final approval vote which looks almost certain to pass. Once the law comes into force, businesses will have three years to fully comply.

What's Your Opinion?

Are these rules sensible? Would you like to see them applied in other countries? Do you take security policies into account when buying gadgets or software?