Cybersecurity Cyber Resilience Act: What the industry can expect

Related Vendors

FAULHABER Drive Systems

Wuxi InfiMotion Technology Co., Ltd.

The EU's Cyber Resilience Act is expected to be adopted in 2024 and will come into effect with a transition period of 36 months. For manufacturers and retailers, this means: new obligations and regulations. Proper preparation is needed for successful implementation.

Dr. Oliver Hanka is a partner at PwC Germany and an expert in product and industrial security.

With the digital transformation come many new challenges for companies. This is especially true for the industry, because as transformation accelerates, so do the risks of cyber attacks on hardware and software. Security gaps in operational technologies, for example, allow unauthorized access to security-relevant areas such as industrial control systems (shortly: ICS) and in consequence not only endanger operational processes, but in the worst case even human lives. To protect critical production processes, IT and OT security must be well coordinated. Awareness of this is growing: According to the "Digital Trust Insights" study by PwC, 36 percent of German companies currently prioritize investments in OT security solutions - eleven percent more than the global average.

With the Cyber Resilience Act (shortly: CRA), the EU plans to counter these product-related risks: The directive creates new requirements and security standards that hardware and software must meet before they can be traded throughout Europe and used, for example, as network components in an OT environment. The directive is expected to be adopted in 2024 and is set to come into force with a transition period of 36 months. However, whoever believes there is still plenty of time to implement the requirements is mistaken. This is because product development cycles often extend over long periods of time. Therefore, companies that manufacture digital products for the industrial sector should act as early as possible. Because in the case of violations, there are fines of up to 15 million euros or up to 2.5 percent of the total global annual turnover. In addition, the responsible authorities can force sales bans and recalls.

Which products fall under the Cyber Resilience Act

The CRA affects all products with digital elements that exchange data directly or indirectly with other devices or networks. It is irrelevant whether these are physical products or pure software components. The same applies to components of a product that are sold separately. For example, the analytics platform of a predictive maintenance system falls under the regulation, as do the sensors or radio modules of the solution. Exceptions are products and components for which there are already other laws that set specific cybersecurity requirements - these include medical products or those of civil aviation. The handling of open-source software, however, is not yet fully clarified. Although open-source providers are exempt from the CRA, manufacturers who use the corresponding software in their products are not.

Clear rules for different product classes

For the correct classification of products under the CRA, different security categories apply: a standard class, critical class I, very critical class II and Annex IIIa products.

Products of the standard class can be checked for compliance with the requirements without an external testing body. The manufacturer has to prove conformity with a self-assessment and document the results. The testing procedures of class I, II or annex IIIa can also be applied by manufacturers for standard class products.

For the critical Class I, higher requirements apply, therefore a self-assessment is not possible. Here, affected manufacturers or traders can apply a harmonized standard defined under the directive to demonstrate the product's full CRA compliance. Well-known and tested standards such as the IEC 62443 are expected here. In such cases, no external testing authority is required. Companies must document compliance with the standards in writing. If there are no harmonized standards, the company must involve an external testing authority (as with Class II products) or use a cybersecurity certification system (as with Annex IIIa). Certification systems and harmonized standards must still be defined by the European Union Agency for Cybersecurity (Enisa).

Products in Class II are considered very critical. Here, manufacturers must involve an external testing authority for examination. There are two options. In the first option, the manufacturer implements a EU type examination: In this case, an external body checks the product's cybersecurity in the sense of the CRA. If the product complies with the regulations of the regulation, the manufacturer must continue to ensure on his own responsibility that the products comply with the type examination in the future. In the second option, the manufacturer demonstrates conformity through a quality assurance system in which an external testing body regularly audits the conformity.

Finally, there are products of Annex IIIa, which only indirectly meet the requirements of Annex I. A cybersecurity certification system determines the requirements and the contents of Annex I relevant to the product. The certification system also provides stipulations for ensuring conformity. If there is no certification system for a product type, the regulations for Class II products apply.

The harmonized standards and certification systems for cybersecurity are not yet finally defined. The European Commission still has to determine these in the framework of implementing legal acts.

Manufacturers need to take action now.

If products fall into one of the mentioned categories, manufacturers and retailers will be required in the future to ensure the required level of cybersecurity throughout the entire product development cycle.

This means: The security of the products must already be considered during the development phase and also ensured during production, delivery, maintenance, and disposal. If exploited vulnerabilities or acute cyber attacks occur, this must be reported within 24 hours to the national Computer Security Incident Response Team (CSIRT), thus to the BSI for Germany. Manufacturers must provide security updates for up to five years or for the expected product lifecycle. For components or entire systems in industrial plants, which are sometimes in use for longer than 20 years, these regulations also apply for the entire lifespan of the product. In addition, manufacturers must comprehensively inform users about possible risks of the products, for example as part of the user manual.

The overview shows: extensive obligations are coming for the affected companies. Therefore, it is important to become active now, check your own products and classify them into the security categories Standard, Critical I, Critical II or Annex IIIa. This involves a certain amount of effort, but those who do not plan a time buffer for preparation for the CRA risk consequences such as fines, recalls or complicated retrofitting requirements. Companies can use the time gained through proactive planning to rectify deficits in a timely manner using standards such as IEC 62443. In this way, manufacturers act in the interests of safety and fulfill their responsibility towards customers and employees. Industrial companies that have planned investments in networked solutions and plants for the near future can check whether they might postpone the purchase to a later date. This would ensure that the purchased systems and components are already CRA-compliant and contribute to a high level of security in the long term.