Cybersecurity NIS-2 And CRA: Impacts on Industrial Automation

Related Vendors

Softing Industrial Automation GmbH

FAULHABER Drive Systems

Compliance with the NIS-2 Directive, the Cyber Resilience Act (CRA), and IEC 62443 presents various challenges for companies. However, these regulations also offer advantages. Early adaptation can not only minimize regulatory risks but also gain competitive advantages through an improved cybersecurity strategy.

The increasing digitalization of industrial processes not only brings efficiency improvements but also new challenges in terms of cybersecurity. Two key regulatory frameworks of the European Union, the NIS-2 Directive (Network and Information Security Directive 2) and the Cyber Resilience Act (CRA), set new standards for protecting industrial automation systems. These regulations have significant implications for companies in the automation industry, particularly with regard to security, compliance, and operational continuity.

NIS-2: New Requirements for Critical Infrastructures

The NIS-2 Directive strengthens the cybersecurity of critical and essential services in the EU. It builds on the original NIS Directive from 2016 and extends its scope to a larger number of companies, including:

• Operators of critical infrastructures (energy, transportation, healthcare
• Manufacturers and operators of industrial automation systems
• Providers of digital services (cloud, data centers, IoT platforms

The main obligations of the NIS-2 Directive for industrial automation companies include:

• Enhanced security measures: Companies must establish effective risk management focused on network security, access control, and incident response.
• Reporting obligations: Security incidents must be reported to the relevant authorities within 24 hours.
• Supply chain security: The security of suppliers and partners is more strongly regulated to minimize vulnerabilities throughout the entire supply chain.

The implementation of the NIS-2 Directive requires industrial automation companies to ensure close collaboration between IT and OT security departments, as well as the integration of security concepts into existing operations.

Cyber Resilience Act (CRA): Strengthening Product Security

In addition to NIS-2, the Cyber Resilience Act (CRA) establishes new standards for the cybersecurity of products with digital elements. Manufacturers of industrial control systems and IIoT devices are particularly affected. The CRA mandates:

• Security by Design: Security features must already be considered during the development phase.
• Vulnerability management: Companies are required to identify and address known security vulnerabilities.
• Long-term update obligations: Security updates must be provided over a defined period.

These requirements aim to enhance the security of industrial automation systems and minimize the risk of cyberattacks.

Control & Regulation

Five New Products in the Category Control & Regulation

IEC 62443: A Proven Security Standard for Automation

In addition to NIS-2 and CRA, the international standard series IEC 62443 also plays a key role in cybersecurity for industrial automation. This standard offers a structured approach to securing automation systems and includes:

• Risk-based security concepts: Companies can adapt security measures according to their individual threat scenarios.
• Network segmentation: Separating critical and non-critical systems reduces the attack surface.
• Identity and access management: The authentication and authorization of users and machines are improved.
• Secure communication: Data is transmitted through encrypted channels to prevent tampering and eavesdropping.

IEC 62443 can support companies in efficiently implementing the requirements of NIS-2 and CRA while establishing a robust cybersecurity strategy.

Challenges And Opportunities for the Industry

Compliance with NIS-2, CRA, and IEC 62443 presents various challenges for companies:

• Legacy systems: Older control and automation solutions often do not meet the new security requirements and need to be updated.
• Increased administrative effort: Implementing new processes for cybersecurity monitoring can be complex.
• Training requirements: Employees must be trained in handling new regulations securely.

At the same time, the new regulations offer significant advantages:

• Increased security and resilience: Companies can better protect themselves against cyberattacks.
• Trust and competitive advantage: Companies that invest in cybersecurity early can position themselves as reliable partners.
• Standardized security processes: A unified security strategy simplifies collaboration within global supply chains.

Implementation of IEC 62443-4-1 at Softing Industrial

Over the past five years, Softing Industrial has increasingly received customer inquiries regarding certification according to IEC 62443-4-1. This part of the specification outlines the requirements for a secure product development process for component manufacturers in the field of industrial automation.

In January 2022, Softing Industrial began expanding its processes to meet these requirements. In June 2023, the company received certification according to the IEC 62443-4-1:2018 standard for its locations in Haar near Munich, Nuremberg, and the development site in Cluj, Romania. The certification process was conducted by TÜV Süd. Since then, the company has been integrating these process expansions into all product developments and implementing the security requirements for components described in IEC 62443-4-2.

Network Segmentation

As outlined above, network segmentation is a key aspect of IEC 62443. The specification recommends dividing communication networks for industrial automation into zones and conduits. These conduits are secured at the transitions between zones to protect against potential attacks. Segmentation can be implemented using standard IT products such as firewalls or more specific products tailored to OT environments.

Softing Industrial offers the Smartlink HW-PN, a product that simplifies the securing of Profinet networks. It establishes a secure access point for applications to Profinet networks and provides suitable interfaces for the following application areas:

• Asset Management
• Network Monitoring
• Process Analysis (IIoT, NOA)

Asset management applications, such as Emerson AMS Device Manager, access Profinet devices via the Smartlink HW-PN to configure parameters and monitor their status. The Smartlink HW-PN provides an FDI communication interface based on the secure communication protocol OPC UA. Communication between the asset management application and the Smartlink HW-PN can be protected and encrypted using certificates. Only authorized application instances can connect to the Smartlink HW-PN via this northbound interface.

On the south side, within the Profinet network, the Smartlink HW-PN acts as a Profinet Supervisor and establishes a "Device IO" connection to the Profinet devices. This allows authorized applications transparent access to the Profinet devices, regardless of the Profinet controller used.

The hardware architecture of the Smartlink HW-PN ensures a secure separation between the northbound application network and the southbound Profinet network. The Ethernet interfaces are managed by separate operating system instances. These separate instances only communicate with each other via a shared memory area, preventing any IP-level access from the north side to the south side.

A complex firewall configuration for application access to the Profinet-Profinet network is no longer necessary with the Smartlink HW-PN.

Real-Time Inventory of Networks

For the secure operation of networks in industrial automation, it is also essential to know which devices with which firmware versions are installed. Theoretically, this should be known from system planning. However, the actual installed state often differs from the planned state ("As-Built" vs. "As-Planned"), especially when the systems have been in operation for a few years.

Softing Industrial offers a network monitoring application for Profibus—and starting in January 2026, also for Profinet networks—with the Plantperfect Monitor product. This application utilizes Softing Industrial Smartlink products to access the network, enabling a real-time inventory of devices installed in the network and establishing a basis for secure operation.

Conclusion

NIS-2, CRA, and IEC 62443 mark an important step towards a more secure and resilient industry. Companies in industrial automation must prepare for extensive security requirements, encompassing both technical and organizational measures. Those who adapt early can not only minimize regulatory risks but also gain competitive advantages through an enhanced cybersecurity strategy.