Cybersecurity requirements for VPN Products: New standardisation under the Cyber Resilience Act

The EU is taking steps towards more specific cybersecurity requirements for VPN products. As part of the standardisation work supporting the Cyber Resilience Act (Regulation (EU) 2024/2847 – “CRA”), the European Telecommunications Standards Institute (ETSI) is developing EN 304 620, a standard setting out cybersecurity requirements for VPN solutions. The standard covers key security aspects of VPN products, including secure communications, encryption and authentication. Its aim is to translate the more general cybersecurity requirements of the CRA into technical requirements that manufacturers can use when developing and assessing their products.

Importantly, EN 304 620 does not introduce a separate EU regulatory regime for VPNs. Rather, it is intended to support compliance with the CRA. Once a harmonised standard is formally referenced in the Official Journal of the European Union, compliance with the relevant standard may give manufacturers a presumption of conformity with the corresponding requirements of the CRA.

The development of the standard is particularly relevant for manufacturers and providers placing VPN products on the EU market. Under the CRA, manufacturers will have to address cybersecurity throughout the product lifecycle, including security by design, vulnerability management and security updates.

Companies operating in this area should follow the development of ETSI’s standards and consider whether their existing product security measures, technical documentation and conformity assessment processes will need to be adjusted. This is particularly relevant as the reporting obligations under the regulation enter into force on 11 September 2026, and CRA will become generally applicable on 11 December 2027.