{"id":3661,"date":"2026-08-18T09:00:00","date_gmt":"2026-08-18T07:00:00","guid":{"rendered":"https:\/\/brentasoft.com\/blog\/cyber-resilience-act-odoo-19-pmi-manifattura-italiane\/"},"modified":"2026-06-10T11:32:56","modified_gmt":"2026-06-10T09:32:56","slug":"cyber-resilience-act-odoo-19-pmi-manifattura-italiane","status":"publish","type":"post","link":"https:\/\/brentasoft.com\/blog\/cyber-resilience-act-odoo-19-pmi-manifattura-italiane\/","title":{"rendered":"Cyber Resilience Act in Odoo: smart products compliance EU 2027 (guida PMI manifattura)"},"content":{"rendered":"<p><em>Settantaduesima guida operativa Odoo 19 per PMI italiane. Il Cyber Resilience Act (CRA, EU 2024\/2847) entra in vigore dicembre 2027 e impone obblighi cybersecurity su tutti i &#8220;prodotti con elementi digitali&#8221; venduti in EU. Smart products manifatturati da PMI italiane (macchinari connessi, dispositivi IoT, soluzioni software embedded, prodotti smart) saranno coperti. Non compliance = no CE marking = no vendita in EU. Sanzioni fino 15M \u20ac o 2.5% fatturato. Le PMI manifatturiere che producono &#8220;smart product&#8221; devono iniziare a prepararsi adesso. In questa guida vediamo come affrontare CRA con Odoo 19.<\/em><\/p>\n<p>Vediamo: scope CRA, le 3 categorie prodotti, requirements security by design, vulnerability management, post-market obligations, SBOM, casi pratici PMI manifatturiere.<\/p>\n<h2>Scope del CRA<\/h2>\n<h3>Cosa \u00e8 &#8220;prodotto con elementi digitali&#8221;<\/h3>\n<ul>\n<li>Software product<\/li>\n<li>Hardware con software<\/li>\n<li>Connected devices<\/li>\n<li>IoT products<\/li>\n<li>Components separable digital elements<\/li>\n<\/ul>\n<h3>Esclusioni<\/h3>\n<ul>\n<li>Open source non commercial<\/li>\n<li>Medical devices (MDR coverage)<\/li>\n<li>Motor vehicles (specific regulation)<\/li>\n<li>Aircraft (specific regulation)<\/li>\n<li>Defence products<\/li>\n<\/ul>\n<h3>Esempi PMI manifattura italiana<\/h3>\n<ul>\n<li>Macchinario industriale con HMI\/connectivity<\/li>\n<li>Smart appliances (elettrodomestici intelligenti)<\/li>\n<li>Dispositivi IoT industriali<\/li>\n<li>Sensori connessi (industrial sensors)<\/li>\n<li>Software embedded in prodotti hardware<\/li>\n<li>Robot industriali con AI<\/li>\n<\/ul>\n<h2>Le 3 categorie prodotti CRA<\/h2>\n<h3>Default category<\/h3>\n<ul>\n<li>Self-assessment conformity<\/li>\n<li>Maggior parte dei prodotti consumer + industrial<\/li>\n<li>CE marking + EU declaration<\/li>\n<\/ul>\n<h3>Important products class I<\/h3>\n<ul>\n<li>Self-assessment OR third-party conformity<\/li>\n<li>Esempi: identity management systems, browsers, password managers, VPN, firewall, antivirus<\/li>\n<\/ul>\n<h3>Important products class II<\/h3>\n<ul>\n<li>Third-party conformity assessment mandatory<\/li>\n<li>Esempi: OS, hypervisor, smart cards, smart meter gateways, robot industriali con cognitive features<\/li>\n<\/ul>\n<h3>Critical products<\/h3>\n<ul>\n<li>European cybersecurity certification mandatory<\/li>\n<li>Hardware Security Modules, smartcard secure elements<\/li>\n<\/ul>\n<h2>Timeline applicazione<\/h2>\n<h3>Dicembre 2027<\/h3>\n<ul>\n<li>Full application requirements<\/li>\n<li>CE marking obbligatorio per prodotti CRA-scope<\/li>\n<\/ul>\n<h3>Settembre 2026<\/h3>\n<ul>\n<li>Reporting actively exploited vulnerabilities<\/li>\n<li>Reporting severe incidents<\/li>\n<\/ul>\n<h3>Periodo transitorio<\/h3>\n<ul>\n<li>Tempo per preparation<\/li>\n<li>Standardization in progress<\/li>\n<li>Guidance documents released<\/li>\n<\/ul>\n<h2>Product security by design<\/h2>\n<p>Ogni smart product manufactured deve dimostrare &#8220;security by design and by default&#8221;. Il product record in Odoo deve documentare design choices security, threat model, security features implemented, certificazioni applicabili:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-cra-01-product.png\" alt=\"Product security by design CRA Odoo 19 PMI manifattura italiane\" class=\"aligncenter size-full wp-image-3656\"\/><\/p>\n<ul>\n<li>Security requirements specifications<\/li>\n<li>Threat model documentation<\/li>\n<li>Security features implemented<\/li>\n<li>Cryptography used + key management<\/li>\n<li>Authentication mechanisms<\/li>\n<li>Default secure configurations<\/li>\n<li>Update mechanism secure<\/li>\n<\/ul>\n<h2>Production con security integrated<\/h2>\n<p>Il MO per smart products deve integrare security check + provisioning sicuro durante manufacturing. La supply chain di security (chip, firmware, certificates) richiede tracciabilit\u00e0 completa:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-cra-02-mo.png\" alt=\"MO security manufacturing CRA Odoo 19 PMI manifattura italiane\" class=\"aligncenter size-full wp-image-3657\"\/><\/p>\n<ul>\n<li>Secure provisioning steps<\/li>\n<li>Cryptographic keys management<\/li>\n<li>Default credential rotation<\/li>\n<li>Firmware version control<\/li>\n<li>Quality check security functions<\/li>\n<li>Audit trail provisioning<\/li>\n<\/ul>\n<h2>SBOM (Software Bill of Materials)<\/h2>\n<p>Il CRA richiede SBOM per ogni prodotto: lista completa software components + versions + licenses. La BOM in Odoo estesa con software components diventa il punto di documentazione SBOM:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-cra-03-sbom.png\" alt=\"SBOM Software Bill of Materials CRA Odoo 19 PMI manifattura\" class=\"aligncenter size-full wp-image-3658\"\/><\/p>\n<ul>\n<li>Software components identified<\/li>\n<li>Version specifico per componente<\/li>\n<li>License + restrictions<\/li>\n<li>Vulnerability tracking per component<\/li>\n<li>Standard format (SPDX, CycloneDX)<\/li>\n<li>Update process documented<\/li>\n<li>End-of-support dates<\/li>\n<\/ul>\n<h2>Vendor security requirements<\/h2>\n<p>Component vendors devono fornire informazioni security + SBOM. Il PO emesso deve includere security requirements + SBOM delivery, supply chain attack prevention \u00e8 chiave per CRA compliance:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-cra-04-po.png\" alt=\"PO vendor security requirements CRA Odoo 19 PMI manifattura\" class=\"aligncenter size-full wp-image-3659\"\/><\/p>\n<ul>\n<li>Security requirements contract<\/li>\n<li>SBOM delivery obligation<\/li>\n<li>Vulnerability disclosure cooperation<\/li>\n<li>Security update commitment<\/li>\n<li>End-of-life notification<\/li>\n<li>Audit right cybersecurity<\/li>\n<\/ul>\n<h2>Post-market support obligations<\/h2>\n<p>CRA obbliga security support per &#8220;expected lifetime&#8221; del prodotto (minimum 5 anni). Sale order tracking + customer relationship in Odoo abilita la gestione lifecycle support sicurezza:<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-cra-05-sale.png\" alt=\"Sale order post-market security support CRA Odoo 19 PMI\" class=\"aligncenter size-full wp-image-3660\"\/><\/p>\n<ul>\n<li>Sold products linked to customer<\/li>\n<li>Update delivery mechanism<\/li>\n<li>Security notice channel<\/li>\n<li>End-of-support communication<\/li>\n<li>Vulnerability remediation timeline<\/li>\n<li>Customer support documented<\/li>\n<\/ul>\n<h2>Vulnerability handling obligations<\/h2>\n<h3>Vulnerability disclosure policy<\/h3>\n<ul>\n<li>Public contact point obbligatorio<\/li>\n<li>CVD (Coordinated Vulnerability Disclosure) process<\/li>\n<li>Acknowledgement researchers<\/li>\n<li>Communication clear<\/li>\n<\/ul>\n<h3>Reporting actively exploited vulnerabilities<\/h3>\n<ul>\n<li><strong>24h<\/strong>: early warning to ENISA<\/li>\n<li><strong>72h<\/strong>: vulnerability notification<\/li>\n<li><strong>14 giorni<\/strong>: final report con corrective measures<\/li>\n<li>Coordination con CSIRT national<\/li>\n<\/ul>\n<h3>Severe incident reporting<\/h3>\n<ul>\n<li>Definition: &#8220;significant impact&#8221; su availability\/confidentiality\/integrity<\/li>\n<li>Reporting timeline analogue<\/li>\n<li>Customer communication parallel<\/li>\n<li>Forensic analysis required<\/li>\n<\/ul>\n<h2>Essential cybersecurity requirements<\/h2>\n<h3>Design + development<\/h3>\n<ul>\n<li>No known exploitable vulnerabilities at release<\/li>\n<li>Secure default configuration<\/li>\n<li>Confidentiality + integrity protection<\/li>\n<li>Access control adequate<\/li>\n<li>Resilience to attacks<\/li>\n<\/ul>\n<h3>Vulnerability handling<\/h3>\n<ul>\n<li>Public vulnerability disclosure process<\/li>\n<li>Security updates available throughout support period<\/li>\n<li>Documentation security features<\/li>\n<li>Transparency on incidents<\/li>\n<\/ul>\n<h3>Support period<\/h3>\n<ul>\n<li>Minimum 5 anni (or product lifetime if shorter)<\/li>\n<li>Security updates free of charge<\/li>\n<li>Updates separate da feature updates<\/li>\n<li>Clear communication EOL<\/li>\n<\/ul>\n<h2>Conformity assessment options<\/h2>\n<h3>Self-assessment (default + class I)<\/h3>\n<ul>\n<li>Internal assessment per requirements<\/li>\n<li>Technical documentation<\/li>\n<li>EU declaration of conformity<\/li>\n<li>CE marking<\/li>\n<li>Cost: 8-35k \u20ac first product<\/li>\n<\/ul>\n<h3>Third-party assessment (class II + critical)<\/h3>\n<ul>\n<li>Notified body involvement<\/li>\n<li>Technical file review<\/li>\n<li>Possibly factory audit<\/li>\n<li>Certificate issued<\/li>\n<li>Cost: 25-100k \u20ac first product<\/li>\n<\/ul>\n<h3>European cybersecurity certification<\/h3>\n<ul>\n<li>Critical products only<\/li>\n<li>ENISA certification scheme<\/li>\n<li>Cost: 50-250k \u20ac + lengthy process<\/li>\n<\/ul>\n<h2>Costi tipici CRA compliance<\/h2>\n<h3>Setup iniziale primo prodotto<\/h3>\n<ul>\n<li>Threat modeling + security design: 15-50k \u20ac<\/li>\n<li>Security testing: 12-40k \u20ac<\/li>\n<li>Documentation: 8-25k \u20ac<\/li>\n<li>SBOM tooling + setup: 5-15k \u20ac<\/li>\n<li>Vulnerability management: 8-25k \u20ac<\/li>\n<li>Conformity assessment: 8-100k \u20ac (varia)<\/li>\n<li><strong>Totale primo prodotto: 56-255k \u20ac<\/strong><\/li>\n<\/ul>\n<h3>Prodotti successivi (economy of scale)<\/h3>\n<ul>\n<li>Setup costo: -50\/70% rispetto primo<\/li>\n<li>Reuse design patterns + tools<\/li>\n<li>Conformity assessment specific solamente<\/li>\n<\/ul>\n<h3>Ricorrente annuale<\/h3>\n<ul>\n<li>Vulnerability monitoring: 15-40k \u20ac<\/li>\n<li>Security update delivery: 10-30k \u20ac<\/li>\n<li>Reporting + communication: 5-15k \u20ac<\/li>\n<li>Training + awareness: 5-15k \u20ac<\/li>\n<li><strong>Totale: 35-100k \u20ac\/anno<\/strong><\/li>\n<\/ul>\n<h2>Errori comuni CRA prep<\/h2>\n<h3>&#8220;Pensare &#8216;i nostri prodotti non sono digital'&#8221;<\/h3>\n<p><strong>Problema<\/strong>: hardware con qualsiasi software\/connectivity \u00e8 scope.<br \/>\n<strong>Soluzione<\/strong>: legal review per scope assessment.<\/p>\n<h3>&#8220;Security come after-thought&#8221;<\/h3>\n<p><strong>Problema<\/strong>: security tested at end, fundamental issues found late.<br \/>\n<strong>Soluzione<\/strong>: security by design, integrated dal product roadmap.<\/p>\n<h3>&#8220;SBOM ignored&#8221;<\/h3>\n<p><strong>Problema<\/strong>: software components untracked, vulnerability response slow.<br \/>\n<strong>Soluzione<\/strong>: SBOM automation dal day 1, continuous monitoring.<\/p>\n<h3>&#8220;Support timeline non pianificato&#8221;<\/h3>\n<p><strong>Problema<\/strong>: 5+ anni security support not budgeted.<br \/>\n<strong>Soluzione<\/strong>: lifecycle cost modeling includes long-term security support.<\/p>\n<h3>&#8220;Vendor sec requirements vaghi&#8221;<\/h3>\n<p><strong>Problema<\/strong>: subcontractors deliver insecure components, prodotto finale impossibile certificare.<br \/>\n<strong>Soluzione<\/strong>: requirements specifici contratto + audit periodici.<\/p>\n<h2>Casi pratici PMI manifatturiere italiane<\/h2>\n<h3>Caso 1 \u2014 Industrial machinery: smart controls<\/h3>\n<ul>\n<li>Macchinario industriale con PLC + HMI + connectivity<\/li>\n<li>Classification: default category<\/li>\n<li>Self-assessment + technical doc<\/li>\n<li>Investimento: 145k \u20ac first product<\/li>\n<li>Cost subsequent products: 45k \u20ac<\/li>\n<\/ul>\n<h3>Caso 2 \u2014 Smart appliances: consumer product<\/h3>\n<ul>\n<li>Elettrodomestico smart con WiFi<\/li>\n<li>Self-assessment<\/li>\n<li>OTA update mechanism<\/li>\n<li>5 anni support commitment<\/li>\n<li>Investimento: 95k \u20ac<\/li>\n<\/ul>\n<h3>Caso 3 \u2014 Industrial IoT: gateway critical<\/h3>\n<ul>\n<li>Smart meter gateway = important class II<\/li>\n<li>Third-party assessment<\/li>\n<li>Investimento: 180k \u20ac<\/li>\n<li>Customer enterprise contract: salvato 8M \u20ac<\/li>\n<\/ul>\n<h3>Caso 4 \u2014 IoT sensor: surprise scope<\/h3>\n<ul>\n<li>Sensor &#8220;semplice&#8221; ma con connectivity<\/li>\n<li>Late discovery in scope CRA<\/li>\n<li>Recovery: 95k \u20ac + 6 mesi delay<\/li>\n<li>Lesson learned: scope assessment early<\/li>\n<\/ul>\n<h2>FAQ<\/h2>\n<h3>I miei prodotti sono in scope CRA?<\/h3>\n<p>Check: prodotto include software o connectivity? Se s\u00ec, almost certainly scope. Verifica esclusioni (medical, vehicle, etc.). Legal opinion per certainty.<\/p>\n<h3>Quanto tempo serve per essere compliant?<\/h3>\n<p>Default category: 9-18 mesi per primo prodotto. Important class II: 12-24 mesi. Critical: 18-36 mesi. Subsequent prodotti faster.<\/p>\n<h3>Posso usare open source senza problemi?<\/h3>\n<p>S\u00ec ma devi documentare in SBOM + monitor vulnerabilities + provide security updates. Open source &#8220;free&#8221; diventa responsibility tua per CRA purposes.<\/p>\n<h3>Cosa fare se vulnerability discovered post-launch?<\/h3>\n<p>Process: (1) verification; (2) report ENISA within 24h se actively exploited; (3) develop fix; (4) deliver update customers; (5) public disclosure coordinated.<\/p>\n<h3>CRA vs NIS2?<\/h3>\n<p>NIS2: cybersecurity di chi opera servizi essenziali. CRA: cybersecurity dei prodotti venduti. PMI pu\u00f2 essere subject entrambi. Combined approach raccomandato.<\/p>\n<h2>Prossimi passi<\/h2>\n<p>Nelle prossime guide vedremo come <strong>preparare per Forced Labour Regulation EU<\/strong>, come <strong>integrare Data Act<\/strong> per data sharing requirements, e come <strong>gestire DSA\/DMA<\/strong> impatti per PMI che operano marketplace.<\/p>\n<p style=\"margin-top:30px;background:#f4f4f8;padding:18px;border-radius:8px;\"><strong>Vuoi preparare CRA compliance Odoo nella tua PMI manifatturiera?<\/strong><br \/>\nG Tech Group implementa programmi CRA compliance per PMI manifatturiere italiane: scope assessment, security by design, SBOM, vulnerability management, vendor requirements. Track record di PMI pronte before December 2027 deadline.<br \/>\n<a href=\"https:\/\/brentasoft.com\/preventivatore.php\"><strong>Richiedi un preventivo gratuito<\/strong><\/a> oppure prova la nostra <a href=\"https:\/\/odoo.brentasoft.com\/\">demo Odoo 19 live<\/a>. Oppure <a href=\"https:\/\/www.odoo.com?utm_campaign=partner-d192ce8a&amp;utm_source=partner_ref\" target=\"_blank\" rel=\"noopener noreferrer\">prova Odoo direttamente su odoo.com<\/a> (link partner Brentasoft).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Settantaduesima guida Odoo 19: Cyber Resilience Act EU per smart products. Scope, categorie, SBOM, vulnerability handling, support period, casi pratici PMI.<\/p>\n","protected":false},"author":2,"featured_media":3656,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"CRA Cyber Resilience Act Odoo: guida PMI","_seopress_titles_desc":"Cyber Resilience Act EU con Odoo 19 per PMI manifatturiere italiane: smart products, SBOM, vulnerability handling, conformity, casi pratici.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"https:\/\/brentasoft.com\/blog\/cyber-resilience-act-odoo-19-pmi-manifattura-italiane\/","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"https:\/\/brentasoft.com\/blog\/wp-content\/uploads\/2026\/06\/odoo-cra-01-product.png","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","footnotes":""},"categories":[25,689],"tags":[],"class_list":["post-3661","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance-normative","category-guide-odoo"],"_links":{"self":[{"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/posts\/3661","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/comments?post=3661"}],"version-history":[{"count":0,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/posts\/3661\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/media\/3656"}],"wp:attachment":[{"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/media?parent=3661"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/categories?post=3661"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/brentasoft.com\/blog\/wp-json\/wp\/v2\/tags?post=3661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}