Templates for IEC 62443-4-1 compared: what Exida, TÜV SÜD and the free sample process cover, where gaps remain, and what the CRA requires. Contents Exida

The CRA standard EN 40000-1-4 adopts 14 requirement families from EN 18031 and adds four new ones. This has concrete consequences for manufacturers who already

Reporting, monitoring, remediating: the CRA requires three distinct things. Only actively exploited vulnerabilities must be reported, and not every CVE has to be patched. This

More than 60 companies have voluntarily committed to CISA’s Secure by Design Pledge. We put the seven goals into context and compare them with the

Support period, changes, spare parts, cloud connectivity: the Commission’s CRA guidance answers questions that have been left open in the machinery and plant engineering sector

How CRA vulnerability reporting works in practice: SRP submission, CSIRT follow‑up questions and user notification explained step by step. The reporting process of the Cyber

The Cyber Resilience Act defines three reporting stages: early warning, detailed report and final report. This article compares the deadlines and triggers for vulnerabilities and

The CRA Implementation Act names the BSI as the market surveillance and notifying authority for the Cyber Resilience Regulation in Germany. Exactly this point is

Which harmonized standards apply to the CRA? An overview of the EN 40000 series, ETSI EN 304 6xx and EN 50770: structure, status and what

ISO 8102-20 provides industry-specific cybersecurity requirements for elevator systems. The key requirements are summarized concisely. Contents Scope The standard specifies cybersecurity requirements for the following

More than 60 companies have committed to CISA’s Secure by Design pledge to improve software security. The voluntary initiative is discussed alongside the binding EU

The machinery regulation and the CRA apply in parallel to connected machines. Manufacturers should implement both sets of requirements as a single project rather than

How CRA vulnerability reporting works in practice: SRP submission, CSIRT follow-up and informing users step by step. The reporting process of the Cyber Resilience Act

The Cyber Resilience Act defines three reporting stages: early warning, detailed report and final report. Deadlines and triggers for vulnerabilities and security incidents compared. The

The CRA reporting obligations take effect 18 months before the other requirements. Manufacturers must report vulnerabilities from September 2026, including for existing products. The Cyber

CRA: Which obligations for vulnerability handling and SBOM apply to manufacturers, importers and distributors? Explained with a mechanical engineering example and diagram. This article places