--- title: EU Cyber Resilience Act: Evidence Matters | daily.dev description: A three-part series on the EU Cyber Resilience Act concludes with a practical look at building an evidence path for embedded devices so manufacturers can meet... canonical: https://daily.dev/posts/eu-cyber-resilience-act-evidence-matters-fxvgqdgas twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: EU Cyber Resilience Act: Evidence Matters | daily.dev og:description: A three-part series on the EU Cyber Resilience Act concludes with a practical look at building an evidence path for embedded devices so manufacturers can meet... og:url: https://daily.dev/posts/eu-cyber-resilience-act-evidence-matters-fxvgqdgas og:image: https://api.daily.dev/og/posts/FxVGqDGAS.png og:image:alt: EU Cyber Resilience Act: Evidence Matters og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # EU Cyber Resilience Act: Evidence Matters **[Embedded.com](https://daily.dev/sources/embedded-com)** · 11 min read · 0 upvotes · 0 comments ## Summary A three-part series on the EU Cyber Resilience Act concludes with a practical look at building an evidence path for embedded devices so manufacturers can meet CRA incident-reporting deadlines. Starting September 11, 2026, manufacturers must file an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, followed by a fuller notification within 72 hours. The piece explains how to design a small, wear-aware, privacy-conscious non-volatile record (reset cause, boot counter, sequence numbers, security event codes) that survives reboots, using Zephyr's hwinfo, coredump, and NVS subsystems as examples, along with flash-endurance calculations and a six-question drill to test whether a team can actually produce defensible facts within the reporting window. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When do the EU Cyber Resilience Act's incident reporting deadlines take effect? Cyber Resilience Act reporting obligations take effect September 11, 2026. Manufacturers get 24 hours to file an early warning after becoming aware of an actively exploited vulnerability or severe incident, 72 hours for a fuller notification, and a final report afterward. Broader product obligations under the CRA follow later, by December 11, 2027. _Teams tracking CRA compliance deadlines can follow regulatory and embedded security coverage on daily.dev._ ### How do you design a reboot-surviving log record for an embedded device without wearing out flash memory? Keep the record small (around 24 bytes) and write only on meaningful state changes, not periodically. Using Zephyr's non-volatile storage subsystem as a model, a circular layout across four 4-KB sectors rated for 10,000 erases lasts roughly 7.8 years at one write per minute, or about 1.3 years at one write per ten seconds; endurance is part-specific and should be recalculated from the actual MCU datasheet. _Engineers balancing flash endurance against evidence retention can dig into these tradeoffs via daily.dev._ ### What fields should a minimal post-reboot evidence record for security incident reporting include? A defensible record needs the reset cause (raw register value plus normalized label), a boot counter, the firmware build identifier, a bounded sequence of security-relevant events, and the last acknowledged upload checkpoint for backend correlation. Ordering is established via boot counter and monotonic sequence rather than a timestamp, since many embedded products lack a trustworthy RTC or network time at boot. _Developers structuring incident evidence for compliance can explore related embedded security practices on daily.dev._ ## Similar posts on daily.dev - [What the EU CRA actually asks of your engineering team](https://daily.dev/posts/what-the-eu-cra-actually-asks-of-your-engineering-team-syimwsx88) · Kilo Blog · 0 upvotes · 0 comments - [CRA’s First Connected-Products Deadline Is in Less Than 100 Days](https://daily.dev/posts/cra-s-first-connected-products-deadline-is-in-less-than-100-days-7zrubiyyy) · Embedded.com · 0 upvotes · 0 comments - [EU’s Cyber Resiliency Act will put IT leaders to the test](https://daily.dev/posts/eu-s-cyber-resiliency-act-will-put-it-leaders-to-the-test-ufqkjfyfz) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#embedded](https://daily.dev/tags/embedded) [View this post on daily.dev](https://daily.dev/posts/eu-cyber-resilience-act-evidence-matters-fxvgqdgas) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"EU Cyber Resilience Act: Evidence Matters","url":"https://daily.dev/posts/eu-cyber-resilience-act-evidence-matters-fxvgqdgas","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/eu-cyber-resilience-act-evidence-matters-fxvgqdgas"},"datePublished":"2026-09-30T16:02:15.150Z","dateModified":"2026-10-02T08:51:58.280Z","description":"A three-part series on the EU Cyber Resilience Act concludes with a practical look at building an evidence path for embedded devices so manufacturers can meet...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Embedded.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Embedded.com","logo":"https://media.daily.dev/image/upload/s--oPypG_tz--/f_auto,q_auto/v1780213576/logos/embedded-com?_a=BAMAMiWQ0","url":"https://daily.dev/sources/embedded-com"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/eu-cyber-resilience-act-evidence-matters-fxvgqdgas","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,embedded","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Embedded.com","item":"https://daily.dev/sources/embedded-com"},{"@type":"ListItem","position":3,"name":"EU Cyber Resilience Act: Evidence Matters"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/eu-cyber-resilience-act-evidence-matters-fxvgqdgas#faq","mainEntity":[{"@type":"Question","name":"When do the EU Cyber Resilience Act's incident reporting deadlines take effect?","acceptedAnswer":{"@type":"Answer","text":"Cyber Resilience Act reporting obligations take effect September 11, 2026. Manufacturers get 24 hours to file an early warning after becoming aware of an actively exploited vulnerability or severe incident, 72 hours for a fuller notification, and a final report afterward. Broader product obligations under the CRA follow later, by December 11, 2027. Teams tracking CRA compliance deadlines can follow regulatory and embedded security coverage on daily.dev."}},{"@type":"Question","name":"How do you design a reboot-surviving log record for an embedded device without wearing out flash memory?","acceptedAnswer":{"@type":"Answer","text":"Keep the record small (around 24 bytes) and write only on meaningful state changes, not periodically. Using Zephyr's non-volatile storage subsystem as a model, a circular layout across four 4-KB sectors rated for 10,000 erases lasts roughly 7.8 years at one write per minute, or about 1.3 years at one write per ten seconds; endurance is part-specific and should be recalculated from the actual MCU datasheet. Engineers balancing flash endurance against evidence retention can dig into these tradeoffs via daily.dev."}},{"@type":"Question","name":"What fields should a minimal post-reboot evidence record for security incident reporting include?","acceptedAnswer":{"@type":"Answer","text":"A defensible record needs the reset cause (raw register value plus normalized label), a boot counter, the firmware build identifier, a bounded sequence of security-relevant events, and the last acknowledged upload checkpoint for backend correlation. Ordering is established via boot counter and monotonic sequence rather than a timestamp, since many embedded products lack a trustworthy RTC or network time at boot. Developers structuring incident evidence for compliance can explore related embedded security practices on daily.dev."}}]} ```