CRA, the Machinery Regulation and NIS-2 each require their own risk assessment. We explain what manufacturers, integrators and operators must do.
In collaboration it often remains unclear who must take which part. What must the manufacturer already consider? What can only be assessed by the operator on site? And who takes care of the risks that arise when an installation is assembled?
A labeling module with remote maintenance access illustrates the problem: the manufacturer waits for the customer’s security requirements. The customer expects the module to be delivered securely. The integrator is supposed to install it into the packaging line — and must determine whether the protective measures are sufficient for the entire line.
So risks remain unaddressed while everyone assumes someone else will handle them.
The tasks can be clearly assigned: the manufacturer assesses its product, the integrator assesses its integration and the operator assesses the specific use. The assessments build on one another. None replaces the other.
The manufacturer — addressing risks in the product
The manufacturer of the labeling module must assess how its remote maintenance access could be abused and which protective measures are required. They decide on authentication, permissions and secure updates.
They cannot delegate these decisions to the later operator. The CRA requires its own documented cybersecurity risk assessment. It must be integrated into development and updated during the support period if necessary.
Why the manufacturer? Because they design the product. Missing protective features can often only be compensated later by the operator through additional measures in their environment.
The manufacturer must consider the intended and reasonably foreseeable use. Customer requirements help to specify this, but they are not a prerequisite for starting the assessment.
Operating conditions — clearly state what is required
A product does not have to be designed for every conceivable environment. However, the manufacturer must describe under which conditions it can be used safely.
For the labeling module, this could mean, for example:
Such prerequisites belong in the user information. The blanket statement “The operator is responsible for IT security” is not sufficient. Nor can necessary protective measures be replaced by notes in the manual.
A secure default configuration remains the manufacturer’s responsibility, as far as the relevant CRA requirement applies. The operator still has to configure the product and integrate it securely. However, they should not first have to disable unnecessary services to establish a secure baseline.
The manufacturer must make clear what the product provides — and what the operating environment must additionally provide.
Where does your risk assessment stand?
Our Readiness-Check shows you which basics are in place and which next steps are necessary for CRA compliance.
The integrator — assess risks during assembly
Individually assessed components do not yet produce a securely integrated system.
The integrator must check: do the operating conditions of the modules match? Which connections are needed? Do shared networks or remote maintenance accesses create new risks?
Why the integrator? Because risks can arise during assembly that no single component assessment covers.
They also have to clarify their legal role. A company that assembles several modules into a complete packaging line can become the manufacturer of that line under machinery law. Whether additional manufacturer obligations under the CRA arise depends on the resulting product and how it is provided.
“Integrator” is therefore not a fixed legal role. What matters is what the company actually builds, modifies and provides.
The operator — assess risks for their own operation
The operator sees the labeling module as part of their plant. They must know what consequences a failure or manipulation would have:
- Does only the module stop or the entire packaging line?
- Can incorrectly labeled products be processed further without being noticed?
- Does the remote maintenance access open a path to other systems?
From this follow measures for the actual operating environment: segmentation, access rules, controlled maintenance and restart procedures.
For facilities in the NIS-2 scope, appropriate technical, operational and organizational risk management measures are mandatory according to the respective implementation rules. Even outside that scope, a secure operational organization remains sensible.
Why the operator? Because only they know the actual processes, dependencies and consequences of failures.
They should therefore demand concrete answers from the manufacturer: which protective functions does the product provide? What operating conditions apply? Which measures must they add on site?
CRA, MVO and NIS-2 — different tasks, common interfaces
The three regulatory frameworks view risks from different perspectives:
| Regelwerk | Wer trägt die zentrale Verantwortung? | Was muss betrachtet werden? |
|---|---|---|
| CRA | Manufacturer of the covered product | Cybersecurity risks of the product with digital elements |
| MVO | Manufacturer of the machine or incomplete machine | Safety and health risks, including safety-relevant manipulation |
| NIS-2 | Covered entity | Risks for its network and information systems and their operation |
The interfaces are important: if the labeling module is manipulated via the remote maintenance access, it can interrupt production. If the manipulation triggers dangerous machine movements, it also affects machine safety.
The assessments must therefore be coordinated. A product assessment alone does not answer how secure the entire plant is. Conversely, an operational risk assessment does not replace the manufacturer’s obligations.
Standards and CE marking — helpful but not a substitute for your own assessment
IEC 62443-3-2 helps to split an automation system into zones and conduits and to assess its risks. A complete product-related CRA assessment does not automatically result from it.
A CE marking also does not answer all questions. An incomplete machine module, for example, can carry a CE marking due to the CRA even though it receives an installation declaration under machinery law. Which regulations the CE marking covers is shown by the associated EU declaration of conformity.
For the integrator and the operator this means: check declarations and user information. Only from them does it become clear which properties are guaranteed and which operating conditions are assumed.
No one can wait for someone else’s assessment
Product development, integration and plant planning often run in parallel. Information must therefore flow in both directions. Responsibility nevertheless remains clear:
The manufacturer assesses the product. The integrator assesses the interplay. The operator assesses the use in their own operation.
Everyone needs information from the others. No one can completely hand over their own task to them.
For manufacturers this means: Assess your product — even if no customer asks for it.
How complete is your risk assessment as a manufacturer really?
In a few minutes you can see where your product risk assessment stands today and what is still missing for compliance.
