Cyber Resilience Act and IEC 62443: what machine builders and operators of condition monitoring should know

A condition monitoring system on machine tools is a networked product: a box on the plant network, a connection to the CNC control, a connection to the outside and a platform where the analysis takes place. In the EU, such products are covered by the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847). The IEC 62443 series of standards describes how secure components for industrial automation are developed. This article explains, from the operator's point of view, what the Cyber Resilience Act and IEC 62443 mean for condition monitoring, which questions you should ask every supplier and how we answer them for our system.

The Cyber Resilience Act in brief

The CRA places obligations on manufacturers of products with digital elements. This also includes software that is connected to other devices over a network. A subscription business model does not change that. The CRA creates no obligations of their own for operators, but it does set a clear benchmark: you can expect your supplier to meet the requirements, and you should ask about them.

One point is particularly important for condition monitoring. In our assessment, the platform and dashboard count as remote data processing and are part of the product, because the box cannot fulfil its purpose without them. Box, platform and dashboard together are then one product within the meaning of the CRA. A supplier therefore cannot fall back on the argument that only the box is installed at the customer's site.

This means the reporting obligation already applies today. As soon as a single box is running at a customer's site, the manufacturer must be able to report an actively exploited vulnerability as an early warning within 24 hours.

IEC 62443: process and component

The IEC 62443 series is extensive. Two parts are decisive for suppliers of monitoring systems:

• IEC 62443-4-1 describes the secure development process: security requirements and threat model, secure design, testing, vulnerability handling, update management and security guidance for the customer.
• IEC 62443-4-2 describes technical requirements for individual components, graded by security level. Level 2 means protection against intentional attacks using low resources and generic skills.

Both parts fit well with the CRA: what IEC 62443 requires as process and component properties covers a large part of the requirements in Annex I. For our box we have set security level SL-C 2 as the target.

Questions to ask every condition monitoring supplier

The following questions are derived from the requirements of the CRA. They apply to any networked system on your machines, not just condition monitoring. A reputable supplier answers them in writing and without evasion.

Two further questions do not concern the CRA directly but do concern the security of your machines: can the system write to the CNC control? And does it need inbound connections into your network? A monitoring system should need neither.

The reporting route under Article 14

The CRA's reporting obligation is triggered by two events: an actively exploited vulnerability in the product and a severe security incident affecting the security of the product. A vulnerability that the manufacturer finds and fixes itself without it having been exploited is not reportable. It must nevertheless be dealt with.

Reports are made via ENISA's central reporting platform, the Single Reporting Platform. The recipient is the CSIRT of the member state in which the manufacturer has its main establishment. In addition, users must be informed about the incident and possible countermeasures. For you as an operator this means: ask how, and how quickly, you will find out in an emergency what you need to do yourself.

How we implement the Cyber Resilience Act

We are a young company in the market launch phase. That is why we have developed the security process from the start rather than retrofitting it later. The following status is honest: some things are implemented, some exist as drafts.

• SBOM: for every shipped component, i.e. the box and the platform, we generate a software bill of materials in CycloneDX format. Development tools are not included, only what is actually shipped. We make it available to you on request.
• Library checks: with every code check, all libraries used are automatically checked for known vulnerabilities. Versions are pinned and are only updated deliberately and with a full test run. A reported vulnerability blocks the check until it is fixed or documented, with reasons, as not applicable.
• Vulnerability handling: every report receives a reference number and an acknowledgement of receipt, is assessed using CVSS 4.0 and in context, fixed with a test that demonstrates the vulnerability, and shipped as a security update separately from feature updates.
• Reporting route: the process under Article 14, with early warning, notification and final report, is described, with defined responsibilities and a template for informing our customers. For us the recipient is CSIRT-CY, because Forbach and Partners Ltd has its registered office in Cyprus.
• Contact and security.txt: an address for security reports and a security.txt according to RFC 9116 have been prepared.
• Signed updates: the box checks every update for signature, version and checksum. Details are in the article Device certificates and signed updates.
• Threat model: there is a STRIDE risk assessment for the box, connections, platform and supply chain. For each countermeasure it states which test demonstrates it, and it ends with a list of open points.

The architecture itself meets several requirements of Annex I. The box reads the CNC control read-only, secured in four layers, polls at most every 0.1 seconds and so does not impair other devices. It opens no ports and only establishes outbound connections, which keeps the attack surface small. And it only transmits features rather than raw signals, and no operator data, in line with the principle of data minimisation. An overview is on the Data security page.

What this means for your own security

Many machine builders and larger manufacturers are themselves subject to NIS2 and have to manage the security of their supply chain. In concrete terms this means security questionnaires for suppliers, security clauses in contracts and evidence of how vulnerabilities are handled. A supplier that has already documented its SBOM, vulnerability process and reporting route makes this work considerably easier for you.

Also check what the supplier openly names. A threat model without open points is more of a warning sign than a mark of quality. We name our open points in conversation, for example that the installer and update server are still to be defined together with the box hardware. How a pilot project at your site works is described on the Process page. For coordination with your IT team we provide a security sheet; contact us via the contact page.

Frequently asked questions