Product makers

Embedded Technology

For product makers, cybersecurity is about how you design, build, ship and support the product. The EU now makes it a condition of sale.

Industrial product makersEmbedded device makersComponent suppliers
Talk to an advisor See the challenges

How the process runs

From requirement to end of support

A product's security is set by its lifecycle: what you require, how you design and build, how you test and release, and how you handle vulnerabilities for as long as you support it. IEC 62443-4-1 and the CRA both look at the whole of it.

  1. Stage 1: Requirements and design

    Security requirements and a threat model shape the architecture.

    What is involved
    Threat modelSecurity requirementsArchitecture review
    Challenge3

  2. Stage 2: Implementation

    Code is written and third-party components are chosen.

    What is involved
    Secure coding rulesSBOMCode review
    Challenge3

  3. Stage 3: Verification

    The product is tested against its security requirements and for weaknesses.

    What is involved
    Security testingFuzzing and penetration testingVulnerability scanning
    Challenge4

  4. Stage 4: Release

    Builds are signed and shipped with security guidance and a declaration of conformity.

    What is involved
    Signed firmwareUser security guidanceConformity documents
    Challenge4

  5. Stage 5: Maintenance

    Vulnerabilities are handled and fixes delivered for the whole support period.

    What is involved
    Vulnerability handling (PSIRT)Secure updatesReporting to ENISA and CSIRTs
    Challenge1

  6. Stage 6: End of support

    Customers are told how long support lasts and what happens after.

    What is involved
    Support periodEnd-of-life notice
Across the lifecycle

Auditors and the CRA look at these as closely as at the product itself.

Open-source and supplier componentsBuild pipelineSigning keysThe people who own product security
Challenge2

Challenges and our answers

Where it gets hard, and how we tackle it

We start from how you build today and change as little as possible to get you compliant and certified.

  1. 05 Maintenance

    The CRA clock is running

    Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours. From 11 December 2027, products without CE marking under the CRA cannot be placed on the EU market.

    How we tackle it

    A gap assessment against the CRA, then the documents, product changes and conformity route, with the least change to how you build.

    EU CRA Compliance
  2. Across the lifecycle

    Nobody owns product security

    Security often sits with IT, or with one busy architect. Certification bodies and the CRA expect clear ownership and a defined process.

    How we tackle it

    We assign ownership of product cybersecurity, usually to the security architect, add gates to your existing process, and write the documents from how you really build.

    IEC 62443-4-1 SDLC Certification
  3. 01 Requirements and design02 Implementation

    Customers ask for security levels you do not have

    Asset owners now ask for IEC 62443-4-2 security levels: authentication, logging, secure update and hardening.

    How we tackle it

    We set the target security level, find the feature gaps, help design and integrate the new features, and prepare the evidence.

    IEC 62443-4-2 CSA Certification
  4. 03 Verification04 Release

    Evidence written the week before the audit

    Threat models, test records and SBOMs produced in a rush show, and auditors notice.

    How we tackle it

    Evidence produced as part of normal work and reviewed at each gate, with a senior advisor keeping it on track between audits.

    Fractional Product Security Advisor

Where we usually start

Three ways in

01EU CRA ComplianceGap to conformity assessment02IEC 62443-4-1 SDLC CertificationYour way of working, audit-proof03IEC 62443-4-2 CSA CertificationThe features your product is missing

Rules and standards

What applies in embedded technology

  • IEC 62443-4-1International

    The secure development lifecycle for industrial products: eight practices, from security management to security guidelines.

  • IEC 62443-4-2International

    Technical security requirements for components, graded by security level.

  • EU Cyber Resilience ActEuropean Union

    Regulation (EU) 2024/2847. Reporting obligations since 11 September 2026; full application from 11 December 2027.

  • RED Delegated ActEuropean Union

    Regulation (EU) 2022/30: cybersecurity for internet-connected radio equipment since 1 August 2025, using the EN 18031 standards.

Talk to RelyBlue

Operating in embedded technology?

An honest conversation about your OT environment. No sales pressure, no fear tactics.

  • You talk to a senior advisor, never a salesperson