Cloud and security · Industrial
Cyber Resilience Act compliance for connected device makers
We provide Cyber Resilience Act compliance for connected device makers and software vendors: classifying products, building the secure development lifecycle, software bills of materials, vulnerability handling and the reporting process that has applied since September 2026, secure update mechanisms and the technical documentation needed for conformity assessment. We work on the software, process and tooling around your products, and you own the processes and the code.
Checklist · Industrial security
OT security, NIS2 and Cyber Resilience Act checklist
A checklist for operators and manufacturers of industrial and connected products: asset visibility, zones and conduits, remote access, monitoring, patching, recovery, supplier security and the regulatory duties of NIS2 and the Cyber Resilience Act.- 01Eight areas based on IEC 62443 practice, with testable checks.
- 02Incident detection and reporting items for NIS2 and the Cyber Resilience Act.
- 03Supplier and secure development questions for product makers.
- 04Seven questions to put to any vendor or engineering partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
Product scoping and classification
Determination of whether each product is a product with digital elements, its category, and the conformity route that follows from the regulation. - 02
Cybersecurity risk assessment
A documented risk assessment for each product, covering intended use, foreseeable misuse and the essential requirements that apply. - 03
Secure development lifecycle
Security requirements, threat modelling, secure coding, review and testing in the development process, evidenced for each release. - 04
Software bill of materials and component tracking
Generation and maintenance of machine-readable SBOMs, and monitoring of components for known vulnerabilities across product versions. - 05
Vulnerability handling process
Intake of reports, triage, remediation, coordinated disclosure and a published policy, with security updates provided for the support period. - 06
Reporting to authorities
A workflow that detects actively exploited vulnerabilities and severe incidents and submits an early warning, a notification and a final report through the single reporting platform within the deadlines. - 07
Secure update mechanism
Signed, authenticated updates with rollback, automatic security updates by default with a way to opt out, and delivery to devices in the field. - 08
Secure by default configuration
Products delivered without default passwords, with minimal attack surface, data protection by design and a way to reset to a secure state. - 09
Technical documentation and conformity
The technical file, user information and declaration of conformity, with evidence from testing, and support for third-party conformity assessment where the product category requires it.
Reference architecture.
Standards and interfaces
What we design against.
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- Cybersecurity requirements for products with digital elements placed on the EU market, with reporting obligations in application from September 2026 and the main requirements from December 2027.
- Harmonised standards and IEC 62443-4
- European standardisation work for the CRA, with IEC 62443-4-1 (secure development lifecycle) and 4-2 (component requirements) widely used as evidence.
- ETSI EN 303 645 and sector standards
- Baseline security requirements for consumer devices and sector-specific standards that may serve as evidence for particular products.
- SBOM formats
- CycloneDX and SPDX for machine-readable bills of materials, with VEX statements to communicate exploitability.
- Coordinated vulnerability disclosure
- ISO/IEC 29147 and 30111 for receiving and handling vulnerability reports.
- NIST SSDF and SLSA
- Secure software development and supply chain frameworks used to structure the lifecycle evidence.
Data model
The core entities.
- Product and version
- Product, category, versions, support period, markets and conformity status.
- Component
- Name, version, source, licence, supplier and the products it is part of.
- Vulnerability
- Identifier, affected components and versions, severity, exploitation status, fix and disclosure.
- Report to authority
- Type, awareness time, early warning, notification, final report and references.
- Release evidence
- Requirements covered, tests, reviews, scan results and approvals for each release.
- Update campaign
- Target devices, version, stages, success rate and rollback.
- Technical file
- Risk assessment, design documents, test reports, declaration and version history.
When custom development is the right call.
Controls designed in, not added later.
Security through the lifecycle
Requirements, design review, testing and release gates for security are part of how each product is built, not a final check.Signed and verifiable software
Builds, updates and SBOMs are signed, and the provenance of components is recorded.Responsible disclosure
A published contact and policy, with timelines for acknowledging and fixing reported vulnerabilities.Rapid reporting capability
People, on-call arrangements and tooling that can meet a deadline measured in hours.Updates for the support period
Security updates are available for each product throughout the declared support period and delivered securely.
From discovery to a system you run.
- 01
Portfolio scoping and gap assessment
We classify products, review development and support practice against the regulation and agree priorities with engineering, product and legal. - 02
Process and tooling design
The secure development process, SBOM approach, vulnerability workflow and reporting runbook are designed and tooling is chosen. - 03
Implement on pilot products
The process and tools are implemented on one or two products, and evidence is produced for each release. - 04
Exercise reporting and updates
A reporting exercise and an update rollout test the workflow and the on-call arrangements end to end. - 05
Roll out and prepare conformity
The approach extends to all products, with technical files prepared for conformity assessment.
Relevant work
Where to see our work.
Common questions.
- Does the Cyber Resilience Act apply to us?
- It applies to manufacturers, importers and distributors of products with digital elements, meaning hardware and software with a data connection, sold in the EU, with some exclusions for products regulated elsewhere. Check classification for each product.
- What has to be reported and when?
- Actively exploited vulnerabilities and severe incidents affecting product security must be reported. The process starts with an early warning within 24 hours of awareness, a notification within 72 hours and a final report within 14 days of a fix or mitigation for vulnerabilities. This has applied since September 2026.
- Do we need to produce an SBOM?
- Manufacturers must identify and document components and vulnerabilities, including by drawing up an SBOM in a commonly used machine-readable format covering at least top-level dependencies. We build the process to generate and maintain it per release.
- Does IEC 62443 satisfy the regulation?
- It provides strong, widely used evidence for secure development and component security, but it is not an automatic route to compliance. We map the standard's requirements to the regulation's essential requirements and cover the differences.
- Who owns the processes and code?
- You do. The processes, the tooling and the evidence stay yours.