Product cybersecurity
We take product makers through the EU CRA and IEC 62443 certification, with the least change to how your team already builds. We do not certify products: we get you ready, build the evidence as you build, and stand beside you in the audit.
Not one unsuccessful IEC 62443 certification audit.
Why now
The CRA reporting duties already apply, and the rest of the regulation follows. Your customers may ask for IEC 62443 certification well before either date.
RED Delegated Act: cybersecurity for internet-connected radio equipment.
CRA reporting: actively exploited vulnerabilities and severe incidents, early warning within 24 hours.
CRA applies in full: without CE marking under the CRA, no EU market.
Services
CRA compliance and IEC 62443 certification for the products you ship, with the least change to how you build. Each one ends in evidence an auditor can follow.
Three product projects, and what we chose not to doFrom the first gap assessment to the conformity assessment, for every product with digital elements you sell in the EU.
See the serviceA secure development lifecycle built from how you already work, written down once, and certified.
See the serviceFind the security features your product is missing, design them in, and certify the component.
See the serviceAlongside
What we find
And what we do about each. Most are fixed by changing how the work is done, not by writing more documents.
The company has ISO 27001, an information security team and a policy for laptops. Nobody owns the security of the product it ships.
Our answerSecurity ownership for the product assigned, usually to the security architect, with a scope that covers the product rather than the office and a process the engineering team runs.
Security decisions made feature by feature, with no picture of the whole product.
Our answerA threat model that matches the real architecture and is updated when the architecture changes.
Nobody can show which design, code or test satisfies which requirement.
Our answerEvery requirement traced to design, code and test, so the auditor follows one thread.
Documents produced to pass a review rather than by building the product.
Our answerEvidence your process produces as you build, so the audit reads what already exists.
How it runs
The same path for the CRA, IEC 62443-4-1 and IEC 62443-4-2. The standard changes; the way we work does not.
Which products, which regulation or standard, which class or security level. You do only the work the rules ask for.
We compare what your team already does with what the standard asks, and write down only what is missing.
Procedures, features and evidence fitted into your release process and tools, and run first on a pilot release.
The certification body issues the certificate. We prepare the evidence with you and sit beside you in the audit. For the CRA, most products end in your own declaration of conformity.
Where to start
Many product makers need more than one. This is how the three differ, and where each one starts.
| EU Cyber Resilience Act | IEC 62443-4-1 | IEC 62443-4-2 | |
|---|---|---|---|
| What it covers | The product, and how you handle its vulnerabilities for as long as you support it | Your development process: eight practices, from security management to security guidelines | The security features of one component, against a target security level |
| Who asks for it | The law, for every product with digital elements sold in the EU | Customers and tenders. It is also the base for an IEC 62443-4-2 certificate | Customers who need a certified component at a given security level |
| What you end up with | Technical documentation, a declaration of conformity and CE marking. Most products self-assess; some classes need a notified body | A certificate for your process at a stated maturity level | A certificate for the component at a stated security level |
| Deadline | Reporting from 11 September 2026, the rest from 11 December 2027 | None in law; your customers set it | None in law; your customers set it |
| Needs first | Nothing, though an IEC 62443-4-1 process already covers much of the evidence | Nothing | An IEC 62443-4-1 process at maturity level 3 for the practices applied to the product |
| First step | Settle scope and class, then a gap assessment | A gap map against the eight practices | Set the target security level, then a feature gap report |
| The service | EU CRA Compliance | IEC 62443-4-1 SDLC Certification | IEC 62443-4-2 CSA Certification |
Need direction rather than a whole programme? Fractional Product Security Advisor
Questions
Certification against IEC 62443-4-1 and IEC 62443-4-2 means evidencing a secure development lifecycle and the product security requirements for your target security level, audited and certified by a body such as TÜV or exida. Effort depends on where your SDL stands today: a gap assessment tells you that in weeks, and typical journeys run several months from gap to audit. We coordinate the whole path, from gap analysis through evidence preparation to sitting alongside you in the audit, and not one IEC 62443-4-1 or IEC 62443-4-2 audit we have supported has been unsuccessful.IEC 62443-4-2 CSA Certification
Talk to RelyBlue
A product, a market, an audit date. One conversation with a senior advisor, no sales pressure.