Onesight Global: CRA Compliance Without Slowing Time-to-Market
A new framework for outsourced development turns security-by-design from a schedule tax into an operational enabler under the EU Cyber Resilience Act.
Under the EU's Cyber Resilience Act, security is no longer a best practice deferred to release week; it is a legal obligation that must be embedded at the design stage of products with digital elements. Onesight Global highlights that because this mandate is extraterritorial, any company selling covered hardware or software into the European market—regardless of location—is in scope. The firm warns that treating security as a final QA gate is both legally insufficient and operationally dangerous. Delaying hardening until after code is written forces structural rework, inevitably slipping launch dates and creating undefensible risk positions for board-level scrutiny.
Onesight Global offers three critical takeaways to navigate this landscape while maintaining velocity:
- Shift Left via Automation: Security controls must be automated into the CI/CD pipeline rather than treated as a discrete phase at release. Continuous SAST, dependency scanning, and secure-by-default configuration checks catch issues instantly, turning compliance into a delivery enabler that adds almost zero cycle time compared to manual gates.
- Contractual Specificity: "Secure development" in a statement of work is merely a promise without teeth. Onesight recommends translating regulatory intent into enforceable milestones with measurable acceptance criteria, machine-readable SBOM SLAs, and clearly named accountable owners for every finding.
- Continuous Lifecycle Ownership: The CRA requires ongoing vulnerability handling post-launch. To meet this without subcontracting gaps, partners must be vetted to ensure end-to-end ownership of security from day one through the product's entire life cycle, preventing delegation traps that leave compliance undefined.
