CE-Cybersicherheitskonformität (EU Cyber Resilience Act)CE-Cybersicherheitskonformität
(EU Cyber Resilience Act)

Manufacturers must design and develop products with security built in, handle vulnerabilities throughout the product's support period, provide security updates, document their cybersecurity risk assessment, and report actively exploited vulnerabilities and severe incidents to the authorities within set deadlines. Products must complete the required conformity assessment and carry the CE marking with an EU declaration of conformity.

A machine safety risk assessment (ISO 12100:2010) looks at physical hazards from the machine, such as moving parts, and how to protect people from them. A cybersecurity risk assessment looks at threats to the control and communication systems, such as unauthorised access, manipulated commands or malware, and their consequences. The two are linked, because a cyber incident on a control system can create a safety hazard, so they should be considered together.

It typically involves understanding the product and its connections, assessing cybersecurity risks, building in security measures, setting up vulnerability handling and update processes, preparing technical documentation, completing the required conformity assessment, and then affixing the CE marking with an EU declaration of conformity. Prazamana's assessment covers the industrial system, network and risk-evaluation parts of this work.

The CRA is a CE-marking regulation: products in scope will need to meet its requirements and carry the CE marking. A machine may need to meet several EU rules at once, such as the Machinery rules, the Low Voltage Directive, the EMC Directive and the CRA, and the CE marking and declaration of conformity cover all that apply. Prazamana's CE Marking service helps identify which apply to your machine.

IEC 62443 is the international family of standards for the cybersecurity of industrial automation and control systems, and Prazamana uses it to assess risks, identify gaps and recommend measures. It is a recognised framework for industrial security, but following it does not automatically prove conformity with the CRA, which depends on the standards and procedures the EU recognises for that purpose.

Manufacturers are generally expected to keep technical documentation that includes a cybersecurity risk assessment, details of the security measures and the product's components, a process for handling and reporting vulnerabilities, and the EU declaration of conformity. Prazamana's assessment produces an asset overview, network and communication mapping, a cybersecurity risk assessment, a gap analysis, risk-prioritised recommendations and an improvement roadmap, which can feed into this documentation.