Frameworks

The frameworks your assessments map to, as data, not rework.

The CRA's essential requirements are being translated into harmonised standards. Atrekos maps assessments to what is stable today and tracks the drafts as they move.

Status as of 2 October 2026

Full bar = in the product · Two-thirds = in pilot · One-third = planned · Dashed outline = tracking the draft

CRA
Essential requirements, vulnerability handling and user information (Annex I and II)
Mapped in the product
In force; applies 11 Dec 2027
EN 40000 series
Cybersecurity requirements for products with digital elements: vocabulary (-1-1), principles for cyber resilience (-1-2), vulnerability handling (-1-3), generic security requirements mapping to Annex I of the CRA (-1-4)
Tracking the draft
-1-1 and -1-2 approved (2 Oct 2026), publication pending; -1-3 in approval; -1-4 drafting, due 2027
ISA/IEC 62443 series
Industrial automation and control system security; the product maps to part 4-2, component requirements, SL1–SL4
Mapped in the product
Published
IEC 63452
Railway applications cybersecurity; succeeds CLC/TS 50701
In pilot
Final draft (FDIS); publication expected Q4 2026
EN 50770 series
OT security profiles on IEC 62443 for the CRA product categories
Tracking the draft
New projects approved Oct 2025; 6 standards planned; drafting, CENELEC TC 65X
ETSI EN 303 645
Cyber Security for Consumer Internet of Things: Baseline Requirements
Planned
Published
ETSI EN 304 xxx series
17 vertical standards for the CRA's important product classes (Annex III): browsers, operating systems, routers, firewalls, VPNs and more
Tracking the draft
17 drafts in public enquiry; due 31 Dec 2026 (proposed)

Frameworks Atrekos maps assessments to, with status and drafting stage as of 2 October 2026.
Framework	Covers	Status	Stage
CRA	Essential requirements, vulnerability handling and user information (Annex I and II)	Mapped in the product	In force; applies 11 Dec 2027
EN 40000 series	Cybersecurity requirements for products with digital elements: vocabulary (-1-1), principles for cyber resilience (-1-2), vulnerability handling (-1-3), generic security requirements mapping to Annex I of the CRA (-1-4)	Tracking the draft	-1-1 and -1-2 approved (2 Oct 2026), publication pending; -1-3 in approval; -1-4 drafting, due 2027
ISA/IEC 62443 series	Industrial automation and control system security; the product maps to part 4-2, component requirements, SL1–SL4	Mapped in the product	Published
IEC 63452	Railway applications cybersecurity; succeeds CLC/TS 50701	In pilot	Final draft (FDIS); publication expected Q4 2026
EN 50770 series	OT security profiles on IEC 62443 for the CRA product categories	Tracking the draft	New projects approved Oct 2025; 6 standards planned; drafting, CENELEC TC 65X
ETSI EN 303 645	Cyber Security for Consumer Internet of Things: Baseline Requirements	Planned	Published
ETSI EN 304 xxx series	17 vertical standards for the CRA's important product classes (Annex III): browsers, operating systems, routers, firewalls, VPNs and more	Tracking the draft	17 drafts in public enquiry; due 31 Dec 2026 (proposed)

Mapping an assessment to a standard is a projection of your assessment, not a certificate. No CRA harmonised standard has been cited in the Official Journal yet, so no tool can offer a presumption of conformity.