Reducing Costs and Enhancing Security: Modern Testing and Analysis Approaches for Cyber Resilience Act (CRA) Compliance

The Cyber Resilience Act (CRA), coming into force next year, introduces mandatory cybersecurity requirements for all previously unregulated products with digital elements on the EU market. This affects all companies offering such products, including Rolls‑Royce Solutions, which faces several new challenges in software development: adopting certificate‑based processes, reassessing encryption techniques, and accounting for increased execution times.

All legacy software must be updated to meet the new regulations. To prevent late discovery of critical issues, these updates must be tested early in the software lifecycle. Dynamic testbeds are costly and risk long idle periods due to defects such as runtime errors or stack overflows, potentially delaying releases.

Formal methods—especially abstract‑interpretation‑based static analysis—enable early, exhaustive verification of program properties without execution. Rolls‑Royce Solutions uses a preventive toolchain to rule out defects such as stack overflows, runtime errors, and timing violations before dynamic testing. The toolchain includes RuleChecker, Astrée, aiT WCET analysis, StackAnalyzer, and Azure DevOps for continuous integration.

This systematic approach ensures traceable compliance, strengthens regulatory discussions, improves test efficiency, and provides a solid basis for dynamic testing. Initially used in safety‑critical systems, these technologies are now applied broadly to reduce costly dynamic testing and support ongoing CRA compliance.