{"product_id":"cra-supportperiod-2027-sakerhetsuppdateringar-livscykelregister","title":"CRA support period 2027 – security updates, customer information and lifecycle register | Word\/PDF\/Excel","description":"\u003cdiv class=\"mb-product-copy\"\u003e\n\n\u003cp\u003e\u003cstrong\u003eHow long must a manufacturer keep its digital product secure, and how is the end of support clearly communicated to the customer?\u003c\/strong\u003e With this specialist package, you document the expected period of use, support period, vulnerability management, security updates, customer information, and continued access to patches already released. Designed for Swedish manufacturers, product owners, development managers, PSIRT, and companies selling software or connected hardware in the EU.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eQuick facts:\u003c\/strong\u003e 15 customer files: seven editable Word documents (DOCX), seven corresponding searchable and printable PDF files, and an Excel register (XLSX) with nine tabs. Five Swedish working templates, a Swedish user guide, and a separate English user guide for the Swedish templates. The PDF files are not interactive fillable forms.\u003c\/p\u003e\n\n\u003cdiv style=\"border:2px solid #87ADC9;border-radius:9px;padding:17px 19px;margin:18px 0;background:#F0F6FA\"\u003e\n\n\u003ch2\u003ePackage contents\u003c\/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003e01 Support Period Assessment; 02 Security Update Procedure; 03 Customer Information and End of Support; 04 Component Dependencies and Version Tracking; 05 Support Termination and Archiving; 06 Swedish User Guide; 07 English User Guide\u003c\/strong\u003e – all seven in Word and PDF. In addition, \u003cstrong\u003e08 Excel – Support Period and Lifecycle Register\u003c\/strong\u003e. Total 7 DOCX + 7 PDF + 1 XLSX = 15 files.\u003c\/p\u003e\n\n\n\u003c\/div\u003e\n\n\u003cdiv style=\"border:2px solid #87ADC9;border-radius:9px;padding:17px 19px;margin:18px 0;background:#F0F6FA\"\u003e\n\n\u003ch2\u003eWhat the files contain\u003c\/h2\u003e\n\n\u003cp\u003eDecisions and reasons for the expected product lifespan, upstream component support, applicability assessment, release\/test evidence, patch archive, customer texts stating the end of support at least by month\/year, continued access to older security updates, verification checklists, supporting references, and a consolidated Excel overview. Sources and clear legal limitations are included.\u003c\/p\u003e\n\n\n\u003c\/div\u003e\n\n\u003ch2\u003eWho is the package suitable for?\u003c\/h2\u003e\n\n\u003cp\u003eFor example, a Swedish supplier of connected sensors, a software company, a manufacturer with embedded third-party components, or a product team that must document its support policy ahead of the CRA's main application in December 2027.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNot suitable on its own\u003c\/strong\u003e if you need an actual SBOM generator, code analysis, security certification, penetration test, CE declaration, or formal mandatory reporting to a regulatory authority. The template cannot automatically determine the product's applicability or guarantee legal compliance.\u003c\/p\u003e\n\n\u003ch2\u003eFile overview – what does the customer receive?\u003c\/h2\u003e\n\n\u003cdiv style=\"overflow-x:auto\"\u003e\u003ctable\u003e\n\n\u003cthead\u003e\u003ctr\u003e\n\n\u003cth scope=\"col\"\u003eFile\u003c\/th\u003e\n\n\u003cth scope=\"col\"\u003ePurpose\u003c\/th\u003e\n\n\u003cth scope=\"col\"\u003eFormat \/ language\u003c\/th\u003e\n\n\n\u003c\/tr\u003e\u003c\/thead\u003e\n\n\u003ctbody\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e01 Support Period Assessment\u003c\/td\u003e\n\n\u003ctd\u003eWeigh actual expected use, user expectations, component support, and reasons for the chosen period.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish · editable DOCX + searchable PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e02 Security Update Procedure\u003c\/td\u003e\n\n\u003ctd\u003eRecord vulnerability case, test, release, secure distribution, customer advice, and patch access period.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish · DOCX + PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e03 Customer Information and End of Support\u003c\/td\u003e\n\n\u003ctd\u003eText fields for end of support, update paths, secure use, and pre-termination notice.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish · DOCX + PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e04 Component Dependencies and Version Tracking\u003c\/td\u003e\n\n\u003ctd\u003eAssess components, third-party support, version risk, SBOM references, and actions.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish · DOCX + PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e05 Support Termination and Archiving\u003c\/td\u003e\n\n\u003ctd\u003eKeep terminated active support, historical security updates, and technical documentation periods separate.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish · DOCX + PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e06 Swedish User Guide\u003c\/td\u003e\n\n\u003ctd\u003eWorkflow, source matrix, six realistic scenarios, and control questions.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish · DOCX + PDF\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e07 English User Guide\u003c\/td\u003e\n\n\u003ctd\u003eExplanation of the five Swedish working templates and their limitations.\u003c\/td\u003e\n\n\u003ctd\u003eEnglish · DOCX + PDF; not English legal templates\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e08 Excel Register\u003c\/td\u003e\n\n\u003ctd\u003eAdministrative tracking of decisions, patches, components, vulnerabilities, customer information, and actions.\u003c\/td\u003e\n\n\u003ctd\u003eSwedish · editable XLSX\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\n\u003c\/tbody\u003e\n\n\n\u003c\/table\u003e\u003c\/div\u003e\n\n\u003ch2\u003eExcel with nine tabs\u003c\/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eOverview, Products, Period Decisions, Components, Vulnerabilities, Updates, Customer Information, Actions, and Read Me.\u003c\/strong\u003e Record, for example, which products lack a final support decision, short support periods that need to be tested, component gaps, open vulnerabilities, patches with unverified access, and missing customer information. The overview uses tested status formulas and contains no fictional test data.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWarning:\u003c\/strong\u003e Zero open cases may be due to no cases being registered. Excel is not a legal assessment engine, not a vulnerability scanner, and not an automatic approval.\u003c\/p\u003e\n\n\u003ch2\u003eHow to use the documents\u003c\/h2\u003e\n\n\u003col\u003e\n\n\u003cli\u003eDetermine whether the manufacturer and product are covered by the CRA and whether other sector regulations are relevant.\u003c\/li\u003e\n\n\u003cli\u003eDocument the product's expected period of use, customer expectations, and dependency components.\u003c\/li\u003e\n\n\u003cli\u003eJustify the support period – normally at least five years, but longer where the product's expected use requires it; shorter requires a justified shorter period of use.\u003c\/li\u003e\n\n\u003cli\u003eApprove responsibility, resources, vulnerability reception, patching, testing, and secure distribution.\u003c\/li\u003e\n\n\u003cli\u003eClearly state the product's end of support at the time of purchase, at least with month and year, and provide relevant security information.\u003c\/li\u003e\n\n\u003cli\u003eRecord the release date of each update and check continued access during the correct period.\u003c\/li\u003e\n\n\u003cli\u003eDocument technical supporting evidence, evidence of information provision, and re-assessment under changed circumstances.\u003c\/li\u003e\n\n\n\u003c\/ol\u003e\n\n\u003ch2\u003eLegal basis and important dates\u003c\/h2\u003e\n\n\u003cp\u003e\u003ca href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/2847\/oj\/swe\"\u003eRegulation (EU) 2024\/2847 – Cyber Resilience Act\u003c\/a\u003e is the main source. According to \u003cstrong\u003eArticle 13.8\u003c\/strong\u003e, the manufacturer shall choose a support period corresponding to the product's expected period of use. As a general rule, this is at least \u003cstrong\u003efive years\u003c\/strong\u003e, but a shorter period is possible if the product's expected use actually falls below five years. If the period of use is longer, five years may be too short. The basis for the assessment shall be included in the technical documentation.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eArticle 13.9:\u003c\/strong\u003e A security update made available during the support period shall be available for at least \u003cstrong\u003eten years after it is released\u003c\/strong\u003e, or longer if the remainder of the support period is longer. This is a rule regarding availability of the update itself – \u003cstrong\u003enot a general requirement for ten years of active support\u003c\/strong\u003e.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eArticle 13.19\u003c\/strong\u003e requires that the end date of the support period, at least month and year, be clearly stated at the time of purchase. \u003cstrong\u003eAnnex II points 7 and 8\u003c\/strong\u003e cover, among other things, the type of support, update instructions, secure installation, and secure decommissioning. \u003cstrong\u003eAnnex I Part II\u003c\/strong\u003e covers vulnerability management and updates, including secure distribution and user information.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eDates:\u003c\/strong\u003e The main CRA product requirements begin to apply on \u003cstrong\u003e11 December 2027\u003c\/strong\u003e. Reporting obligations under Article 14 for certain actively exploited vulnerabilities and serious security incidents have already applied since \u003cstrong\u003e11 September 2026\u003c\/strong\u003e. Products, roles, transitional rules, applicability, and complementary guidance should be assessed for the relevant manufacturer. The \u003ca href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/policies\/cra-summary\"\u003eEU Commission's CRA overview\u003c\/a\u003e and \u003ca href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/news\/commission-publishes-new-guidance-support-businesses-implementation-cyber-resilience-act\"\u003eguidance from 27 July 2026\u003c\/a\u003e provide additional support.\u003c\/p\u003e\n\n\u003ch2\u003eDifference from Mallbutiken's other CRA products\u003c\/h2\u003e\n\n\u003cp\u003eThe existing \u003ca href=\"\/en\/products\/cyber-resilience-act-cra-compliance-2026-2027-svenska-english-riskbedomning-sbom-incidentrapportering-word-pdf-excel\"\u003eCRA Compliance Package\u003c\/a\u003e has a broad focus on risk assessment, SBOM, and incident requirements. This specialist product focuses on \u003cstrong\u003ethe legal and technical justification of the support period decision, customer information, and continued patch access\u003c\/strong\u003e. PSIRT incident reporting is handled separately. For general operational updates and change planning, the affected organization's own technical processes are also required.\u003c\/p\u003e\n\n\u003ch2\u003eFrequently asked questions\u003c\/h2\u003e\n\n\u003ch3\u003eMust all products be supported for exactly five years?\u003c\/h3\u003e\n\n\u003cp\u003eNo. The support period shall follow the expected period of use and is often longer than five years. A shorter period requires concrete evidence that the product is actually expected to be used for a shorter period.\u003c\/p\u003e\n\n\u003ch3\u003eDoes the ten-year requirement mean we must release new patches for ten years?\u003c\/h3\u003e\n\n\u003cp\u003eNo. Article 13.9 refers to continued access to patches that have actually been released during the support period. This is a separate issue from the length of the active support period.\u003c\/p\u003e\n\n\u003ch3\u003eWhat does the customer need to see at the time of purchase?\u003c\/h3\u003e\n\n\u003cp\u003eAmong other things, the type of technical security support and end of support, clearly and understandably stated with at least month and year.\u003c\/p\u003e\n\n\u003ch3\u003eCan Excel determine if a patch meets the CRA?\u003c\/h3\u003e\n\n\u003cp\u003eNo. Excel summarizes the manual fields that the organization fills in itself and contains no technical scanner or regulatory certification.\u003c\/p\u003e\n\n\u003ch3\u003eAre actual security updates or a machine-readable SBOM included?\u003c\/h3\u003e\n\n\u003cp\u003eNo. Working templates for documentation and secure references are included. Actual development work, testing, and SBOM generation must be done separately.\u003c\/p\u003e\n\n\u003ch3\u003eCan the PDFs be filled in digitally?\u003c\/h3\u003e\n\n\u003cp\u003eThey are searchable and printable but are not interactive PDF forms. Edit the documents in Word and Excel.\u003c\/p\u003e\n\n\u003ch3\u003eAre all documents translated into English?\u003c\/h3\u003e\n\n\u003cp\u003eNo. Five Swedish working templates and Excel are in Swedish; one English user guide is included to explain the workflow.\u003c\/p\u003e\n\n\u003ch2\u003eSources, review level, and version\u003c\/h2\u003e\n\n\u003cp\u003eOfficial sources: \u003ca href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/2847\/oj\/swe\"\u003eEU 2024\/2847\u003c\/a\u003e, \u003ca href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/policies\/cra-summary\"\u003eEU Commission summary\u003c\/a\u003e, \u003ca href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/factpages\/cyber-resilience-act-implementation\"\u003eimplementation timeline\u003c\/a\u003e, and \u003ca href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/news\/commission-publishes-new-guidance-support-businesses-implementation-cyber-resilience-act\"\u003e2026 guidance\u003c\/a\u003e.\u003c\/p\u003e\n\n\u003cp\u003e\u003csmall\u003e\u003cstrong\u003eProduct version:\u003c\/strong\u003e 1.0, 12 November 2026. \u003cstrong\u003eLegal source control:\u003c\/strong\u003e AI-assisted with support from official sources. No independent external legal review, actual product security testing, regulatory review, or CE certification. The files are an adaptable work product and must not be marketed as verified compliance. Delivery via digital ZIP requires separate activation of the store's download function before publication.\u003c\/small\u003e\u003c\/p\u003e\n\n\n\u003c\/div\u003e","brand":"Svenska Dokumentmallar","offers":[{"title":"Default Title","offer_id":56593450107222,"sku":"CRA-SUPPORT-LIFECYCLE-2027-V1","price":79.0,"currency_code":"SEK","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0827\/2373\/3846\/files\/01_CRA_supportperiod_huvudbild_1600.png?v=1794478188","url":"https:\/\/mallbutiken.se\/en\/products\/cra-supportperiod-2027-sakerhetsuppdateringar-livscykelregister","provider":"Mallbutiken","version":"1.0","type":"link"}