The Standardization Request M/606 has been referenced several times in the blog. But what is it?
That is the topic for this article.
The Standardization Request M/606
The Standardization Request M/606 is the official mandate issued by the European Commission to the European Standardization Organizations (CEN, CENELEC, and ETSI). It directs these bodies to draft and deliver the set of European Harmonized Standards (hENs) required to support the implementation of the Cyber Resilience Act (CRA).
Key purpose & scope
The overarching objective of M/606 is to establish standards that manufacturers can use to demonstrate compliance with the CRA’s mandatory Essential Cybersecurity Requirements (Annex I, Parts I and II). Products that comply with these harmonized standards receive an automatic Presumption of Conformity.
M/606 divides the required technical deliverables into 41 standards split across two main structural tiers:
In CEN/CENELEC, work is primarily led by CEN-CLC/JTC 13 (Cybersecurity and Data Protection, particularly WG 9 for horizontal CRA standards and WG 6 for cryptography) and CLC/TC 65X (Industrial-process measurement, control, and automation).
In ETSI, technical work is driven via a dedicated group (ETSI EUSR) under ETSI TC CYBER.
Every standard delivered under M/606 intended for legal presumption of conformity must include an Annex ZA/ZZ mapping standard clauses directly to the corresponding provisions of CRA Annex I.