The Cyber Resilience Act prescribes the result, the implementation is up to you
The Cyber Resilience Act prescribes the result, not the technique. Three concrete requirements explained: secure firmware updates, logging versus data minimisation, and the SBOM.