Choosing the CRA support period for a long-lived machine
The EU Cyber Resilience Act (CRA) requires the security support period of a machine within the CRA's scope to reflect its expected time in use, with a minimum of five years unless expected use is shorter. How the period starts for each unit, fixed or rolling end dates, free security updates and component horizons, with a decision record and a worked example.