Preparing for the Cyber Resilience Act: A Guide for Machine Builders

For years, cybersecurity regulations focused on networks and operators. The EU Cyber Resilience Act changes that. Now the products themselves are in scope, and industrial machinery builders are directly in the crosshairs. This guide explains what the CRA demands, how it affects connected machines, and how manufacturers can build the capabilities to meet it long before the 2026 and 2027 deadlines arrive.

What is the CRA and Why is it Happening?

The Cyber Resilience Act (CRA) is a European Union regulation designed to improve the cybersecurity of products that contain digital components, spanning everything from consumer devices to industrial machinery, software, gateways, controllers, and connected systems. Rather than focusing on how organizations use technology, it focuses on the security of the products themselves.

The reason is simple: connected products have become part of the cybersecurity attack surface.

As manufacturers continue to add connectivity, remote service capabilities, cloud integration, and software-driven features, products are no longer static pieces of equipment. They are active participants in digital ecosystems. That creates tremendous opportunities for efficiency and innovation, but it also creates new risks.

The CRA is a response to a growing reality: many cybersecurity incidents can be traced back to vulnerabilities that were present in products before they were deployed.

Historically, cybersecurity responsibilities often fell primarily on the owner or operator of a system. The CRA introduces a different expectation. Product manufacturers are now expected to consider cybersecurity throughout the product lifecycle, including secure design, vulnerability management, software updates, and incident reporting.

For industrial machinery builders, this represents an important evolution. Modern machines increasingly rely on remote access, software updates, cloud services, and digital service offerings. These capabilities provide real business value, but they also create ongoing cybersecurity responsibilities that extend well beyond product shipment.

The CRA is not simply another compliance requirement. It is a signal that cybersecurity is becoming a fundamental product characteristic, just like safety, reliability, and performance.

Organizations that recognize this shift early will be better positioned to comply with future regulations, strengthen customer trust, and build more resilient digital offerings.

How does the CRA Impact Industrial Automation?

At first glance, the Cyber Resilience Act may appear to be aimed primarily at software companies and consumer technology manufacturers. In reality, many industrial automation companies will be directly affected.

Industrial machines are becoming increasingly connected. Remote service, machine monitoring, predictive maintenance, production analytics, and cloud-based applications are now common features across many industries. These capabilities create value for machine owners and OEMs alike. They also introduce new cybersecurity responsibilities.

The CRA applies to products with digital elements. For industrial automation suppliers, that can include machine controllers, industrial PCs, gateways, embedded software, remote access solutions, and cloud-connected applications.

The impact goes beyond the initial product design. Organizations must also consider how vulnerabilities are identified, managed, communicated, and remediated throughout the product lifecycle. Security can no longer be treated as a one-time engineering exercise completed before shipment.

This creates several practical challenges for industrial machinery builders:

• Long machine lifespans. Machines often remain in service for ten, fifteen, or even twenty years. Cybersecurity obligations may persist long after the original deployment.
• Difficult update environments. Unlike traditional IT systems, machines cannot always be patched immediately. Production schedules, safety considerations, and customer requirements often limit maintenance windows.
• Complex supply chains. Machine builders frequently rely on components and software from multiple suppliers. Understanding where vulnerabilities exist and how they affect deployed assets becomes increasingly difficult as systems grow more complex.

The CRA does not change these realities. What it changes is the expectation that manufacturers must have processes in place to manage them.

This is one reason secure remote service, asset management, software inventories, and lifecycle security are receiving increased attention throughout the industrial sector. These capabilities help organizations understand what has been deployed, where risks exist, and how issues can be addressed efficiently.

For industrial automation companies, the CRA is not simply a compliance challenge. It is an opportunity to rethink how connected products are designed, supported, and maintained throughout their operational life. The organizations that approach cybersecurity as an ongoing service capability rather than a regulatory burden will likely be the ones that gain the greatest long-term advantage.

The Importance of International Standards in OT Cybersecurity

One of the biggest challenges in industrial cybersecurity is knowing where to start. Cybersecurity threats evolve constantly, technologies change rapidly, and regulations continue to emerge around the world. For OEMs and machine builders, trying to navigate these requirements independently can be overwhelming.

This is why international standards play such an important role. Standards provide a common framework for designing, deploying, and maintaining secure industrial systems. Rather than creating cybersecurity practices from scratch, organizations can build on established guidance developed by industry experts, manufacturers, operators, and regulatory bodies.

In operational technology (OT) environments, two frameworks are particularly influential:

• IEC 62443 focuses specifically on industrial automation and control systems, addressing topics such as secure product development, system architecture, access control, risk management, and lifecycle security.
• The NIST Cybersecurity Framework provides practical approaches for identifying, protecting, detecting, responding to, and recovering from cybersecurity risks.

While regulations such as the CRA establish legal obligations, standards provide the practical roadmap for meeting them. The CRA generally describes what manufacturers are expected to achieve. Standards such as IEC 62443 help explain how organizations can build processes and architectures capable of achieving those objectives.

For industrial machinery builders, standards also create consistency. Customers increasingly expect suppliers to demonstrate cybersecurity maturity. Referencing recognized standards helps create a common language between OEMs, machine owners, integrators, and security teams.

Perhaps most importantly, standards encourage organizations to think about cybersecurity as a lifecycle responsibility rather than a collection of individual features. Secure remote access, vulnerability management, software updates, asset inventories, and risk assessments are not isolated activities. They are interconnected elements of a broader cybersecurity program.

As the CRA deadlines approach, organizations that align their products and processes with established standards will likely find themselves better prepared for both compliance and customer expectations. Cybersecurity regulations may continue to evolve. The principles behind strong cybersecurity, however, remain remarkably consistent.

What does State-of-the-Art Vulnerability Handling Look Like for Industrial Machinery?

The Cyber Resilience Act introduces a concept that appears repeatedly throughout the regulation: manufacturers must implement "state-of-the-art" cybersecurity practices. For many industrial machinery builders, that raises an obvious question: what does that actually look like?

The answer is not a specific technology. It is a process.

Historically, vulnerability management in industrial environments has often been reactive. A vulnerability is discovered, customers are notified, and remediation efforts begin. While this approach may have been sufficient in the past, modern connected machinery requires a more structured lifecycle approach.

State-of-the-art vulnerability handling has four key components:

1. Visibility. Manufacturers need to understand what software, firmware, operating systems, libraries, and digital components exist within their products. Without this visibility, it becomes difficult to determine whether a newly disclosed vulnerability affects deployed machines.
2. Assessment. Organizations need a repeatable process for monitoring vulnerability disclosures, evaluating potential impact, and prioritizing remediation activities. Not every vulnerability requires the same response. Some may pose minimal risk in a specific machine architecture, while others may require immediate action — particularly in industrial environments where uptime, safety, and production continuity must be balanced against cybersecurity concerns.
3. Communication. Customers increasingly expect transparency regarding cybersecurity risks and remediation plans. Manufacturers need mechanisms for informing customers about vulnerabilities, available mitigations, and recommended actions.
4. Remediation. A patch that cannot be deployed efficiently provides limited value. Organizations should consider how software updates, configuration changes, and security fixes can be delivered throughout the product lifecycle. This is one reason secure remote service capabilities are becoming increasingly important — they provide a mechanism for implementing remediation activities without requiring unnecessary site visits or lengthy service delays.

Ultimately, state-of-the-art vulnerability handling is not about eliminating every vulnerability. It is about creating a repeatable system for identifying, assessing, communicating, and addressing them throughout the operational life of a machine. That lifecycle mindset sits at the heart of both the CRA and modern industrial cybersecurity practices.

The Importance of Asset Management and the SBOM

One of the most difficult questions in cybersecurity is often the simplest: what exactly do we have deployed?

For industrial machinery builders and machine owners alike, answering that question can be surprisingly challenging. Modern machines contain a growing collection of software, firmware, operating systems, communications components, libraries, and third-party technologies. Over time, this complexity makes it increasingly difficult to understand which assets may be affected when a new vulnerability is disclosed.

This is where asset management becomes essential. Effective asset management provides visibility into the digital components that make up a machine and the software versions currently deployed in the field. Without that visibility, vulnerability management becomes largely reactive and dependent on manual investigation.

One tool receiving increased attention is the Software Bill of Materials (SBOM) — often compared to an ingredient list for software. It documents the software components, libraries, dependencies, and other digital elements included within a product. When a vulnerability is disclosed in a commonly used software component, an SBOM allows manufacturers to quickly determine whether that component exists within their products. Without one, organizations may spend days or weeks attempting to answer a question that should take minutes.

For industrial machinery, however, asset management extends beyond software alone. Manufacturers also need visibility into deployed machines, gateway devices, firmware versions, communication architectures, and supporting digital services. Understanding what is installed, where it is located, and how it is configured becomes increasingly important throughout the machine lifecycle.

You cannot effectively manage what you cannot see.

This visibility enables faster vulnerability assessments, more targeted remediation efforts, and improved customer communication. As connected products become more complex, asset management and SBOMs are increasingly becoming foundational elements of a modern cybersecurity program rather than optional administrative exercises.

Why Machine Owners Need to Rely on Machine Builders for Vulnerability Remediation

When a cybersecurity vulnerability is discovered, machine owners often assume they can address the issue themselves. In practice, vulnerability remediation for industrial machinery is rarely that simple.

Unlike traditional IT systems, industrial machines are highly specialized products. The software, firmware, controllers, communications systems, and operational logic within a machine are typically designed, validated, and maintained by the original machine builder. As a result, machine owners frequently depend on OEMs to determine both the impact of a vulnerability and the appropriate remediation strategy.

The CRA reinforces this reality. Manufacturers are increasingly expected to understand the cybersecurity characteristics of their products throughout the product lifecycle — including assessing vulnerabilities, developing mitigations, and providing guidance to customers. Even when a security update is available, deployment may require testing, validation, compatibility checks, and operational planning. Applying a patch without understanding its potential impact on machine behavior can introduce risks of its own.

This creates a shared responsibility model:

• Machine builders are responsible for understanding the product and developing appropriate remediation measures.
• Machine owners are responsible for maintaining their environments, implementing recommended actions, and coordinating remediation activities within their operational constraints.

As industrial machinery becomes increasingly connected, this collaboration becomes even more important. Organizations need efficient ways to identify affected assets, communicate remediation requirements, and deploy updates when necessary. This is one reason many manufacturers are investing in secure connectivity and remote service capabilities — these technologies help bridge the gap between vulnerability discovery and practical remediation.

The CRA recognizes something industrial organizations have understood for years: cybersecurity does not end when a machine ships. In many ways, that is when the responsibility truly begins.

Why Secure Remote Service is the Best Method for Handling Vulnerabilities on Industrial Machines

When a vulnerability is discovered in an industrial machine, the challenge is rarely identifying the problem. The challenge is fixing it.

Industrial equipment often operates in environments where downtime is expensive, service resources are limited, and machines may be distributed across multiple facilities, regions, or even continents. Historically, vulnerability remediation frequently required an on-site visit — a technician would travel to the machine, assess the issue, apply updates, verify functionality, and document the results. While effective, this approach is difficult to scale.

The CRA places increased emphasis on vulnerability remediation throughout the product lifecycle. As a result, machine builders need practical methods for supporting deployed assets long after they have left the factory. This is where secure remote service becomes increasingly important.

A properly designed remote service capability allows manufacturers to assess, troubleshoot, configure, and update connected machines without requiring a site visit for every issue. When vulnerabilities are identified, OEMs can respond more quickly, evaluate the impact of the issue, and implement remediation measures with significantly less disruption.

The key word is secure. Industrial environments cannot rely on broad network access, shared credentials, or ad-hoc remote connectivity. Vulnerability remediation itself should not create new cybersecurity risks. Modern remote service architectures increasingly rely on principles such as:

• Zero Trust — no implicit access, every connection verified
• Least privilege — access limited to exactly what is needed
• Session auditing — full visibility into what happened during a remote session
• Machine-level access control — permissions scoped to individual assets

These controls help ensure that remote access remains targeted, transparent, and aligned with customer security requirements. Beyond remediation, secure remote service also improves communication and collaboration. Machine builders gain visibility into deployed systems. Customers gain confidence that support can be delivered efficiently when needed.

In a world of connected machinery, secure remote service is no longer just a convenience. It is becoming an essential part of responsible product lifecycle management.

How A CPS Protection Platform Helps Industrial Machine Builders Comply with the CRA

One of the central goals of the Cyber Resilience Act is ensuring that manufacturers can understand, manage, and remediate cybersecurity risks throughout the product lifecycle. That objective sounds straightforward. In practice, it requires visibility.

Manufacturers cannot assess vulnerabilities if they do not know which assets are deployed. They cannot prioritize remediation if they do not know where affected software is running. They cannot communicate effectively with customers if they lack visibility into machine configurations and digital components.

A Cyber-Physical System (CPS) Protection Platform helps address this challenge by providing a centralized framework for understanding connected assets throughout their lifecycle. Instead of viewing machines as isolated systems, a CPS Protection Platform creates visibility across fleets, sites, customers, and digital components.

This visibility supports several important CRA objectives:

Equally important, a CPS Protection Platform helps connect cybersecurity activities with operational realities. Industrial environments must balance security, uptime, service requirements, and customer expectations. Effective asset management provides the context needed to make informed decisions rather than reactive ones.

The CRA does not explicitly require a CPS Protection Platform. What it does require are outcomes that become significantly easier to achieve when organizations have comprehensive visibility into their connected assets. As industrial systems continue to become more connected, asset management is evolving from an operational convenience into a cybersecurity necessity.

Practical Steps to Prepare for the September 2026 Deadline

Beginning in September 2026, manufacturers will be expected to comply with important CRA requirements related to vulnerability handling and reporting processes. While full product compliance deadlines arrive later, organizations should view 2026 as a major milestone rather than a preliminary checkpoint.

The good news is that preparation does not require solving every cybersecurity challenge at once. Instead, organizations should focus on building the foundational processes that support long-term compliance:

1. Start with visibility. Develop a clear understanding of the software, firmware, operating systems, and digital components that exist within your products. If software inventories and SBOM practices are not already established, now is the time to begin.
2. Evaluate vulnerability management processes. How are vulnerabilities identified? Who assesses their impact? How are customers notified? How are remediation activities tracked? These questions are becoming increasingly important under the CRA.
3. Review incident response and reporting procedures. The ability to investigate cybersecurity issues, collect relevant information, and coordinate internal responses will become increasingly valuable as reporting obligations expand.
4. Assess secure remote service capabilities. Many industrial machinery builders are discovering that efficient vulnerability remediation depends on having practical ways to support deployed machines throughout their operational life.
5. Clarify organizational ownership. Cybersecurity responsibilities often span engineering, product management, service, IT, and executive leadership. Clear accountability helps ensure that vulnerability management remains a coordinated process rather than a collection of disconnected activities.

The September 2026 deadline is best viewed as the beginning of operational readiness. Organizations that use this period to establish visibility, processes, and governance will be significantly better positioned for the broader compliance requirements that follow.

Practical Steps to Prepare for the December 2027 Deadline

Unlike the September 2026 milestone, which focuses heavily on vulnerability handling and reporting processes, the December 2027 deadline represents the point at which many CRA product requirements become fully applicable. By then, manufacturers will need more than policies. They will need operational evidence that cybersecurity has been incorporated throughout the product lifecycle.

Preparing for 2027 does not require starting from scratch. Most organizations should focus on five key areas:

1. Establish cybersecurity as a product discipline. Historically, cybersecurity was often treated as an IT responsibility. The CRA reinforces that cybersecurity is also a product responsibility. Engineering, product management, service, and leadership teams all need to be aligned around this shift.
2. Improve visibility into deployed assets. Manufacturers should understand what products are deployed, which software components they contain, and how those assets are supported throughout their operational life.
3. Mature vulnerability management processes. Organizations should be able to identify vulnerabilities, assess their impact, communicate with customers, and coordinate remediation activities in a repeatable way.
4. Evaluate update and support mechanisms. When remediation is required, how will updates be delivered? How will customers be notified? How will changes be validated?
5. Align with recognized cybersecurity standards. Frameworks such as IEC 62443 and NIST provide practical guidance for implementing many of the processes that the CRA expects manufacturers to maintain.

Perhaps the most important takeaway is that compliance should not be viewed as a one-time project. The CRA is encouraging manufacturers to adopt lifecycle cybersecurity practices that continue long after a product is shipped. Organizations that treat cybersecurity as an ongoing capability rather than a deadline-driven exercise will find themselves better positioned not only for compliance, but also for customer trust, operational resilience, and future digital service offerings.

Key Considerations for Global Compliance in OT Cybersecurity

The Cyber Resilience Act is a European regulation. Cybersecurity, however, is a global challenge.

For many industrial machinery builders, products are designed in one country, manufactured in another, and deployed across multiple regions around the world. As a result, organizations increasingly find themselves navigating a growing collection of cybersecurity expectations rather than a single set of requirements.

Rather than approaching cybersecurity requirements as a collection of separate regional obligations, organizations can focus on building a common cybersecurity foundation that supports multiple compliance objectives simultaneously. International standards play an important role in this approach. Frameworks such as IEC 62443 provide a globally recognized basis for securing industrial automation and control systems. Because these standards are widely accepted across industries and regions, they help organizations establish cybersecurity programs that remain relevant even as regulations evolve.

The same principle applies to operational capabilities. Asset management, secure remote service, software inventory management, vulnerability handling, and lifecycle security are valuable regardless of which regulatory framework is being considered. Organizations that invest in these capabilities often discover that compliance becomes a byproduct of good cybersecurity practices rather than a separate initiative.

There is also a practical business consideration. Customers increasingly evaluate cybersecurity as part of procurement and supplier qualification processes. Demonstrating cybersecurity maturity can influence purchasing decisions, service relationships, and long-term customer trust.

In this sense, cybersecurity is becoming more than a compliance requirement. It is becoming a competitive differentiator.

The CRA may be one of the most visible cybersecurity regulations today. It is unlikely to be the last. By building strong cybersecurity foundations now, industrial machinery builders can position themselves to adapt not only to today's requirements, but also to whatever comes next. The goal is not simply to comply with a regulation. It is to build products and services that remain secure, trusted, and resilient throughout their lifecycle.

ABOUT THE AUTHOR

Adam Griffen is the Cybersecurity & Compliance Manager at ei³, bringing over 10 years of experience across automation, product management, and industrial digital security. He has worked in roles ranging from operator and technician to engineer and product manager, giving him a practical understanding of the cybersecurity, compliance, and operational challenges manufacturers face. Adam also serves as Chair of OMAC’s Digital Transformation Workgroup, contributing to initiatives involving PackML and OPC UA standards.

Adam Griffen name

Connect with me on Linkedin