EU Cyber Resilience Act: How companies are preparing for security requirements.

Cyber Resilience Act Three immediate measures for companies

2024-10-28 From Fraunhofer IEM | Translated by AI 4 min Reading Time

On October 10, the EU adopted the Cyber Resilience Act (CRA), which sets minimum requirements for the security of connected devices. Fraunhofer IEM has three tips on what companies should do now to prepare for the CRA.

In its Secure Engineering Lab in Paderborn, Fraunhofer IEM supports companies in adapting their processes and products to the new EU directives.(Image: Fraunhofer IEM) — In its Secure Engineering Lab in Paderborn, Fraunhofer IEM supports companies in adapting their processes and products to the new EU directives.
(Image: Fraunhofer IEM)

The Cyber Resilience Act (CRA) has long been announced, and now it's official: it was passed on October 10, 2024. As a result, starting from November 2027, a new set of EU-wide minimum security requirements will apply to a wide range of connected devices and their software, with vulnerability reporting obligations even taking effect in August 2026. Product manufacturers are particularly called upon to ensure their products meet the security criteria for the European market, with few exceptions, irrespective of the industry. For many years, the Fraunhofer IEM has been developing security measures with companies such as Adesso Mobile Solutions, Connext, Phoenix Contact, and Kraft Maschinenbau, and it offers advice on how businesses can prepare for the CRA.

"The transition period until the CRA must be fully complied with by 2027 is short. Companies need to reorganize in many areas—starting from conducting security risk analyses to short-term reporting obligations when vulnerabilities are discovered, and providing free security updates during the expected lifetime of the product. Procrastination is not an option, as non-compliance with the CRA could result in multi-million euro fines," explains Dr. Matthias Meyer, Head of Software Engineering and IT Security at Fraunhofer IEM.

The research institute recommends that companies take three actions now to begin the path towards CRA-compliant product development. "Quick response to the discovery of vulnerabilities and systematic risk analyses are essential measures to meet CRA requirements: Companies that address these measures now are well on their way. Additionally, a current state analysis in terms of products and processes provides clarity for further action," emphasizes Meyer.

1. Establish a rapid response team for emergencies

When manufacturers become aware that vulnerabilities in their products are being exploited, they will, in the future, inform the European Union Agency for Cybersecurity (ENISA): Within 24 hours they must issue an initial alert, and within 72 hours provide further details on the nature of the vulnerability, possible countermeasures, and more. Moreover, they must be continuously available for individuals wanting to report security gaps and must keep track of whether vulnerabilities become known in any software components supplied. These are among the responsibilities of a Product Security Incident Response Team (PSIRT). Manufacturers who have not yet established a PSIRT should urgently do so, as these obligations must be met by June 2026 for all products on the market, including those launched long before the CRA came into effect.

BEST OF INDUSTRY AWARD

Stimmen Sie jetzt für die Besten der Besten!

Das große Online-Voting für den Best of Industry Award 2024 hat begonnen. Stimmen Sie heute noch für die spannendsten Innovationen aus den Bereichen Fertigung und Konstruktion, Prozessindustrie sowie Labor- und Medizintechnik!

Jetzt abstimmen!

2. Threat and risk analyses as a central tool

At its core, the CRA requires manufacturers to regularly analyze their products for security risks and integrate security measures tailored to these risks. Companies must firmly embed the conduct of threat and risk analyses for all products into the development process: This way, they systematically identify threats, assess the respective security risks, and derive informed and targeted protective and countermeasures. As a result, the security level of the software can be continuously and appropriately enhanced. Development teams gain a new awareness of security, and costly, yet unnecessary measures can even be avoided.

3. Overview through current state analysis

While the first two measures are important, they will not be sufficient: Companies need to understand which requirements of the CRA they meet, both in terms of their processes throughout the product lifecycle and the actual products themselves. Although there are no harmonized standards for the CRA yet, there is a consensus among experts that the existing standard for industrial cybersecurity, IEC 62443, provides very good guidance. Therefore, companies do not need to wait; they can already perform current state analyses for their processes and products, derive measures, and thus gain valuable time in the implementation of the CRA.

Collaboration with Phoenix Contact, Miele, and other companies

The expertise of Fraunhofer IEM is based on many years of project experience with companies.

In 2018, the scientists at Fraunhofer IEM helped Phoenix Contact become one of the first companies to be certified according to the cybersecurity standard IEC 62443-4-1 by developing a tailored method for threat and risk analysis specific to the company.

Since then, Fraunhofer IEM has further developed the method and applied it in numerous threat analysis workshops and training sessions, for example with Kraft Maschinenbau. "We benefit not only from a risk assessment for our products. During the workshop with Fraunhofer IEM, our employees also learned a systematic approach for future threat analyses and increased their security awareness," says Managing Director Jörg Timmermann.

To ensure that its durable products remain secure after market launch, Miele set up its own PSIRT team in 2021 in collaboration with Fraunhofer IEM. Through stakeholder interviews, they were able to build on existing company processes and create clearly defined process interfaces.

Subscribe to the newsletter now

Don't Miss out on Our Best Content

Business E-mail

Please enter a valid mailadress.

By clicking on „Subscribe to Newsletter“ I agree to the processing and use of my data according to the consent form (please expand for details) and accept the Terms of Use. For more information, please see our Privacy Policy. The consent declaration relates, among other things, to the sending of editorial newsletters by email and to data matching for marketing purposes with selected advertising partners (e.g., LinkedIn, Google, Meta)

Date: 08.12.2025

Naturally, we always handle your personal data responsibly. Any personal data we receive from you is processed in accordance with applicable data protection legislation. For detailed information please see our privacy policy.

Consent to the use of data for promotional purposes

I hereby consent to Vogel Communications Group GmbH & Co. KG, Max-Planck-Str. 7-9, 97082 Würzburg including any affiliated companies according to §§ 15 et seq. AktG (hereafter: Vogel Communications Group) using my e-mail address to send editorial newsletters. A list of all affiliated companies can be found here

Newsletter content may include all products and services of any companies mentioned above, including for example specialist journals and books, events and fairs as well as event-related products and services, print and digital media offers and services such as additional (editorial) newsletters, raffles, lead campaigns, market research both online and offline, specialist webportals and e-learning offers. In case my personal telephone number has also been collected, it may be used for offers of aforementioned products, for services of the companies mentioned above, and market research purposes.

Additionally, my consent also includes the processing of my email address and telephone number for data matching for marketing purposes with select advertising partners such as LinkedIn, Google, and Meta. For this, Vogel Communications Group may transmit said data in hashed form to the advertising partners who then use said data to determine whether I am also a member of the mentioned advertising partner portals. Vogel Communications Group uses this feature for the purposes of re-targeting (up-selling, cross-selling, and customer loyalty), generating so-called look-alike audiences for acquisition of new customers, and as basis for exclusion for on-going advertising campaigns. Further information can be found in section “data matching for marketing purposes”.

In case I access protected data on Internet portals of Vogel Communications Group including any affiliated companies according to §§ 15 et seq. AktG, I need to provide further data in order to register for the access to such content. In return for this free access to editorial content, my data may be used in accordance with this consent for the purposes stated here. This does not apply to data matching for marketing purposes.

Right of revocation

I understand that I can revoke my consent at will. My revocation does not change the lawfulness of data processing that was conducted based on my consent leading up to my revocation. One option to declare my revocation is to use the contact form found at https://contact.vogel.de. In case I no longer wish to receive certain newsletters, I have subscribed to, I can also click on the unsubscribe link included at the end of a newsletter. Further information regarding my right of revocation and the implementation of it as well as the consequences of my revocation can be found in the data protection declaration, section editorial newsletter.

In preparation for the industrial cybersecurity standard IEC 62443, KEB assessed the current state of its development processes. Fraunhofer IEM conducted interviews with executive managers and safety experts from the company and assisted KEB in planning further necessary activities for implementing the standard, estimating the effort required, and systematically advancing compliance with the standard.

To ensure that all employees involved in software development stay up-to-date and continuously improve their software development skills, Fraunhofer IEM also collaborates in the area of employee training, for example with Adesso Mobile Solutions and Connext. Both companies have been using Security Champions for years as multipliers for the topic of cybersecurity in their software development.