身份管理系统及特权访问管理软件和硬件
提供身份认证或授权机制，并管理身份凭据全生命周期的产品。
类别解释
Identity management systems and privileged access management
此类产品提供身份认证或授权机制，并管理自然人、法人、设备或系统的身份凭据生命周期，包括身份注册、配置、维护与注销；访问管理系统用于控制对数字资源或物理场所的访问。特权访问管理软件则对组织内部 IT 或 OT 系统及敏感信息的访问权限进行控制和监测。本类别包括但不限于身份认证与访问控制读取设备、生物识别读取设备、单点登录软件、联合身份管理软件、一次性密码软件、交易认证码（TAN）生成器等硬件认证设备、身份认证软件及多因素认证软件。
English
These products provide authentication or authorisation mechanisms and manage the lifecycle of identity credentials for natural persons, legal persons, devices or systems, including registration, provisioning, maintenance and deregistration; access management systems control access to digital resources or physical locations. Privileged access management software controls and monitors access rights to IT or OT systems and sensitive information. The category includes authentication and access control readers, biometric readers, single sign-on, federated identity management, one-time password software, hardware authenticators such as TAN generators, authentication software and multi-factor authentication software.
CRA 附件三 I 类，技术描述见实施条例 (EU) 2025/2392 附件一第 1–19 项
Class I of Annex III to the CRA, with technical descriptions in Annex I, points 1–19, of Implementing Regulation (EU) 2025/2392
制造商可采用协调标准（或技术规范）证明符合性，据此完成内部合格评定；未适用协调标准时，须按模块 B+C 或模块 H 由公告机构参与评定。
Manufacturers may demonstrate conformity through harmonised standards or technical specifications and self-assess; where no harmonised standard is applied, Module B+C or Module H with a notified body applies.
重要产品 · I 类的主要义务
在默认类别要求基础上，针对该类别核心功能落实更严格的安全设计与默认安全配置。
按所选路径完成合格评定，保留技术文档、风险评估与测试证据以备市场监管核查。
建立结构化的漏洞处理流程，并在支持周期内持续发布安全更新。
English
- On top of the baseline obligations, apply stricter secure-by-design and secure-by-default measures for the core functionality.
- Complete the conformity assessment on the chosen route and keep technical documentation, risk assessments and test evidence for market surveillance.
- Operate a structured vulnerability handling process and release security updates throughout the support period.