Sick and Fraunhofer AISEC develop cybersecurity tool QuBA-libre

Cyber Resilience Act Sick Develops Cybersecurity Tool

2025-12-17 Source: Press release of Sick AG | Translated by AI 2 min Reading Time

Related Vendors

Taiwan Machine Tool & Accessory Builders' Association (TMBA)

SIMTOS (Seoul International Machine Tool Show)

Sick, together with the Fraunhofer Institute AISEC, has developed the open-source tool "QuBA-libre." The questionnaire-based system is designed to support companies in the risk assessment of digital products while meeting the requirements of the EU Cyber Resilience Act.

The risk assessment tool QuBa-libre, jointly developed by the Fraunhofer Institute for Applied and Integrated Security AISEC and SICK AG, enables the validation of the cybersecurity status of products such as sensors or edge devices, as well as simple systems, already during their development cycle.(Image: Sick) — The risk assessment tool QuBa-libre, jointly developed by the Fraunhofer Institute for Applied and Integrated Security AISEC and SICK AG, enables the validation of the cybersecurity status of products such as sensors or edge devices, as well as simple systems, already during their development cycle.
(Image: Sick)

Together with the Fraunhofer Institute for Applied and Integrated Security (AISEC), Sick AG has developed the risk assessment tool "QuBA-libre." The tool is designed to validate the cybersecurity status of products. This applies to sensors or edge devices as well as simple systems already during their development cycle. According to Sick, the questionnaire-based assessment enables quick and precise analysis and evaluation of risks. Furthermore, the open-source tool generates suggestions for countermeasures to mitigate identified risks. After completing the risk analysis, "QuBA-libre" automatically creates a list of actions that summarizes the results and maps them to the requirements of the CRA.

Cyber Resilience Act Comes into Force in 2027

The EU Cyber Resilience Act, adopted in 2024 and coming into force mandatorily in 2027, aims to significantly improve the cybersecurity of products with digital elements. To achieve this, the regulation (Cyber Resilience Act—CRA) sets requirements for the cybersecurity of such products throughout their entire lifecycle. The regulation is intended to ensure that only products without known vulnerabilities enter the market. Therefore, the CRA explicitly mandates risk assessments for all products with digital elements.

Early Integration into the Development Process

With the questionnaire-based assessment method of "QuBA-libre," it should be possible to conduct risk assessments already in the early phases of product or system development. As required by the CRA, this could avoid attack surfaces and allow suitable protective measures to be planned during the design and conceptual phases. According to the manufacturer, potential security gaps could thus be identified and corrected early in product development. The concepts for the cybersecurity of products and systems created on this basis are intended to ensure that protection mechanisms are directly integrated into the product design.

Automated Result And Requirement Documentation

By capturing responses to questions about impact assessment and required attack potential, as well as through automated risk evaluation and the generation and allocation of appropriate protective measures using integrated catalogues based on IEC 62443-4-2, "QuBA-libre" aims to enable a comprehensive analysis of the cybersecurity of a product or simple system. Any remaining risks are identified and made available for evaluation by cybersecurity specialists. Upon completing the risk assessment, "QuBA-libre" automatically generates a list of actions summarizing the results and mapping them to the requirements of the CRA. According to the manufacturer, the tool is designed to establish CRA-compliant cybersecurity as a quality feature.

Subscribe to the newsletter now

Don't Miss out on Our Best Content

Business E-mail

Please enter a valid mailadress.

By clicking on „Subscribe to Newsletter“ I agree to the processing and use of my data according to the consent form (please expand for details) and accept the Terms of Use. For more information, please see our Privacy Policy. The consent declaration relates, among other things, to the sending of editorial newsletters by email and to data matching for marketing purposes with selected advertising partners (e.g., LinkedIn, Google, Meta)

Date: 08.12.2025

Naturally, we always handle your personal data responsibly. Any personal data we receive from you is processed in accordance with applicable data protection legislation. For detailed information please see our privacy policy.

Consent to the use of data for promotional purposes

I hereby consent to Vogel Communications Group GmbH & Co. KG, Max-Planck-Str. 7-9, 97082 Würzburg including any affiliated companies according to §§ 15 et seq. AktG (hereafter: Vogel Communications Group) using my e-mail address to send editorial newsletters. A list of all affiliated companies can be found here

Newsletter content may include all products and services of any companies mentioned above, including for example specialist journals and books, events and fairs as well as event-related products and services, print and digital media offers and services such as additional (editorial) newsletters, raffles, lead campaigns, market research both online and offline, specialist webportals and e-learning offers. In case my personal telephone number has also been collected, it may be used for offers of aforementioned products, for services of the companies mentioned above, and market research purposes.

Additionally, my consent also includes the processing of my email address and telephone number for data matching for marketing purposes with select advertising partners such as LinkedIn, Google, and Meta. For this, Vogel Communications Group may transmit said data in hashed form to the advertising partners who then use said data to determine whether I am also a member of the mentioned advertising partner portals. Vogel Communications Group uses this feature for the purposes of re-targeting (up-selling, cross-selling, and customer loyalty), generating so-called look-alike audiences for acquisition of new customers, and as basis for exclusion for on-going advertising campaigns. Further information can be found in section “data matching for marketing purposes”.

In case I access protected data on Internet portals of Vogel Communications Group including any affiliated companies according to §§ 15 et seq. AktG, I need to provide further data in order to register for the access to such content. In return for this free access to editorial content, my data may be used in accordance with this consent for the purposes stated here. This does not apply to data matching for marketing purposes.

Right of revocation

I understand that I can revoke my consent at will. My revocation does not change the lawfulness of data processing that was conducted based on my consent leading up to my revocation. One option to declare my revocation is to use the contact form found at https://contact.vogel.de. In case I no longer wish to receive certain newsletters, I have subscribed to, I can also click on the unsubscribe link included at the end of a newsletter. Further information regarding my right of revocation and the implementation of it as well as the consequences of my revocation can be found in the data protection declaration, section editorial newsletter.