Assessing Cyber Resilience Act (CRA) with IEC 62443

The EU Cyber Resilience Act, formally Regulation (EU) 2024/2847, creates a horizontal cybersecurity framework for products with digital elements placed on the EU market, including hardware, software, and relevant remote data processing solutions.

For manufacturers of industrial automation, OT, IoT, embedded systems, control components, connected machinery, networked devices, firmware, and software products, the Cyber Resilience Act is not simply another cybersecurity guideline. It is a market access regulation that links cybersecurity to product compliance, lifecycle assurance, CE marking, technical documentation, vulnerability handling, and post-market obligations.

IEC 62443 is one of the most relevant technical frameworks for such manufacturers because it addresses security for Industrial Automation and Control Systems across product development, component security, system security, risk assessment, patch management, service provider requirements, and asset owner security programs.

However, IEC 62443 should not be treated as a complete substitute for Cyber Resilience Act compliance. Current IEC 62443 implementation can provide strong evidence for many CRA cybersecurity requirements, but the CRA also introduces legal, conformity, market surveillance, CE marking, user information, reporting, and economic operator obligations that sit outside the normal scope of IEC 62443.

What the Cyber Resilience Act Requires

The Cyber Resilience Act applies to products with digital elements made available on the EU market, where their intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network.

The regulation covers both final products and separately placed components, including software and hardware components, where they meet the definition of a product with digital elements.

The CRA is intended to address two major product cybersecurity weaknesses: products being placed on the market with vulnerabilities and users not receiving sufficiently clear information or security updates to operate those products securely.

The CRA entered into force on 10 December 2024, its reporting obligations apply from 11 September 2026, and the main obligations apply from 11 December 2027.

At a practical level, the CRA requires manufacturers to integrate cybersecurity into planning, design, development, production, vulnerability handling, support, and maintenance activities throughout the product lifecycle.

The regulation also requires products to bear the CE marking where they comply with the applicable CRA requirements, and certain higher-risk products may require third-party conformity assessment by a notified body before being placed on the EU market.

Why IEC 62443 Matters for CRA Compliance

IEC 62443 is a series of standards for securing Industrial Automation and Control Systems, and it covers both process-related and technical cybersecurity requirements.

The series is especially important for OT and industrial product manufacturers because it provides a structured way to demonstrate secure development, risk-based design, technical security capabilities, defense in depth, patch management, and vulnerability handling.

IEC 62443 is organized into several parts, including general concepts, policies and procedures, system-level security, and component-level requirements.

For CRA alignment, the most relevant parts are IEC 62443-4-1, which addresses secure product development lifecycle requirements, and IEC 62443-4-2, which addresses technical security requirements for IACS components.

IEC 62443-3-2 is also relevant because it provides a security risk assessment methodology for system design, which aligns well with the CRA’s risk-based cybersecurity expectations.

IEC 62443-3-3 supports system security requirements and security levels, which can help product manufacturers and system integrators align product capabilities with intended deployment environments.

IEC 62443-2-3 is relevant to CRA because patch management and vulnerability remediation are central to the CRA’s lifecycle obligations.

CRA and IEC 62443: Strategic Alignment

The strongest alignment between CRA and IEC 62443 exists in the areas of secure development, product security capabilities, vulnerability handling, patch management, security testing, authentication, access control, integrity, confidentiality, availability, logging, and risk assessment.

The weaker alignment exists in CRA-specific areas such as CE marking, EU declaration of conformity, economic operator obligations, market surveillance, mandatory reporting timelines, user transparency, open-source steward obligations, and legal evidence structures.

The Joint Research Centre and ENISA have specifically noted that CRA requirements need to be translated into harmonized standards so manufacturers can use standards-based conformity routes, and their standards mapping work identifies existing cybersecurity standards and gaps against CRA requirements.

This means that manufacturers already using IEC 62443 have a strong head start, but they still need a CRA-specific compliance layer that converts IEC 62443 evidence into regulatory evidence.

Practical CRA to IEC 62443 Alignment

CRA requirement area	IEC 62443 alignment	Assessment
Risk-based secure design	IEC 62443-3-2 supports security risk assessment for system design, and IEC 62443-4-1 supports secure development lifecycle practices.	Strong
Secure development lifecycle	IEC 62443-4-1 directly supports secure product development lifecycle requirements.	Strong
Technical product security	IEC 62443-4-2 defines technical security requirements for IACS components.	Strong
Authentication and access control	IEC 62443 includes identification and authentication control and use control as key security concepts.	Strong
Confidentiality and integrity	IEC 62443 includes technical and system-level requirements supporting confidentiality and integrity in industrial control environments.	Strong
Availability and resilience	IEC 62443 addresses resource availability, defense in depth, and lifecycle security for IACS environments.	Strong
Patch management	IEC 62443-2-3 addresses patch management in IACS environments.	Strong to partial
Vulnerability handling	IEC 62443 supports vulnerability management, but CRA adds statutory reporting and lifecycle obligations.	Partial
SBOM and component transparency	IEC 62443 supports product lifecycle governance, but CRA requires product-specific component and vulnerability documentation.	Partial
User information and secure use guidance	IEC 62443 supports secure operation concepts, but CRA requires market-facing user information and transparency.	Partial
CE marking and conformity assessment	IEC 62443 certification may support evidence, but CRA requires regulatory conformity assessment and CE marking.	Gap
Economic operator obligations	CRA defines obligations for manufacturers, importers, distributors, and authorised representatives, while IEC 62443 uses industrial stakeholder roles.	Gap
Market surveillance documentation	IEC 62443 provides useful evidence, but CRA requires specific technical documentation and declaration structures.	Partial

Key Assessment Findings

Finding 1: IEC 62443 is highly suitable for technical CRA implementation

Manufacturers of industrial components, embedded systems, network devices, industrial software, controllers, gateways, sensors, actuators, remote access systems, engineering tools, and IoT platforms can use IEC 62443 as the main technical cybersecurity framework for CRA readiness.

IEC 62443-4-1 is particularly valuable because CRA expects cybersecurity to be embedded into development and maintenance processes, not bolted onto the product after release.

IEC 62443-4-2 is equally valuable because CRA requires products to include appropriate technical security capabilities based on risk, and this part of IEC 62443 provides component-level security requirements for IACS products.

Finding 2: CRA requires regulatory evidence beyond IEC 62443

A product may be developed according to IEC 62443 and still lack the CRA-specific documentation needed for conformity assessment, CE marking, vulnerability reporting, support period justification, user instructions, or market surveillance.

This is why CRA readiness should include a dedicated evidence pack that maps legal requirements to product design evidence, secure development evidence, test evidence, vulnerability handling evidence, update evidence, and user-facing documentation.

Finding 3: Vulnerability handling must become a managed compliance process

The CRA places strong emphasis on vulnerability handling throughout the lifecycle of the product, and reporting obligations begin before the full CRA application date.

IEC 62443 can support vulnerability handling through secure development and patch management practices, but manufacturers must add CRA-specific procedures for statutory notification, support period management, user communication, and post-market evidence retention.

Finding 4: Product classification will influence conformity strategy

The CRA distinguishes products by risk and relevance, and products of particular cybersecurity importance may be subject to additional conformity assessment expectations.

For OT manufacturers, products such as industrial firewalls, secure gateways, remote access products, network management tools, identity systems, embedded operating systems, and control system components should be carefully assessed for their CRA classification and conformity route.

Finding 5: Harmonized standards will be important, but waiting is risky

The JRC and ENISA have already mapped CRA requirements to existing standards to support future standardization and harmonization work.

Manufacturers should not wait until the end of the transition period to act, because product redesign, secure development lifecycle changes, SBOM implementation, vulnerability disclosure processes, update mechanisms, and technical documentation can require significant lead time.

CRA–IEC 62443 Implementation Roadmap

Manufacturers should treat CRA readiness as a phased transformation program rather than a one-time compliance exercise. The roadmap below uses IEC 62443 as the technical implementation backbone while adding the CRA-specific regulatory evidence needed for conformity assessment, CE marking, vulnerability reporting, user information, and post-market surveillance.

Phase	Objective	Key activities	IEC 62443 focus	CRA evidence output
Phase 1: Scope and classify products	Confirm which products, components, software, firmware, and remote data processing elements fall under CRA.	Build a product inventory, identify products with digital elements, assess intended and foreseeable use, determine economic operator roles, classify product risk, and identify whether third-party conformity assessment may be needed.	IEC 62443-3-2 for risk context and system-level security assumptions.	CRA scope register, product classification record, conformity route decision log, and regulatory responsibility matrix.
Phase 2: Establish governance and secure development baseline	Embed cybersecurity into product governance before design, release, and maintenance decisions.	Assign product security ownership, define secure development policies, integrate threat modelling, security requirements, secure design reviews, secure coding, third-party component control, and release gates into engineering processes.	IEC 62443-4-1 secure product development lifecycle practices.	Secure development policy, product security plan, security requirements baseline, threat model, design review records, and release approval evidence.
Phase 3: Implement technical security controls	Ensure products provide appropriate security capabilities based on risk and intended use.	Implement authentication, access control, secure communication, integrity protection, logging, secure update mechanisms, resource availability protections, secure defaults, and hardening guidance.	IEC 62443-4-2 component security requirements and IEC 62443-3-3 system security principles.	Security architecture, technical control mapping, test evidence, secure configuration baseline, and residual risk record.
Phase 4: Build vulnerability handling and reporting capability	Prepare for CRA vulnerability and incident reporting obligations before they apply.	Set up vulnerability monitoring, coordinated vulnerability disclosure, triage criteria, incident escalation, patch planning, user notification, statutory reporting workflows, and support period management.	IEC 62443-4-1 issue management and security update management; IEC 62443-2-3 patch management.	Vulnerability handling procedure, disclosure policy, reporting workflow, patch process, support commitment, and post-release monitoring evidence.
Phase 5: Create SBOM and component transparency capability	Maintain visibility over software, firmware, open-source components, dependencies, and known vulnerabilities.	Generate and maintain SBOMs, link components to product versions, monitor vulnerability feeds, define supplier evidence requirements, and incorporate component risk into product release and maintenance decisions.	IEC 62443-4-1 secure implementation, verification, issue management, and update management practices.	SBOM repository, dependency risk records, supplier security evidence, vulnerability monitoring logs, and component change history.
Phase 6: Prepare conformity and CE marking evidence	Convert IEC 62443 implementation evidence into CRA-ready regulatory documentation.	Map CRA essential cybersecurity requirements to IEC 62443 controls, compile technical documentation, prepare user instructions, define support and update commitments, create conformity assessment files, and prepare the EU declaration of conformity.	IEC 62443-4-1 and 4-2 evidence mapped to CRA-specific obligations.	CRA control mapping, technical documentation file, user information pack, conformity assessment evidence, EU declaration of conformity draft, and CE marking readiness record.
Phase 7: Operationalize post-market surveillance	Maintain compliance after product release and throughout the support lifecycle.	Monitor vulnerabilities, manage updates, retain evidence, review product changes for substantial modification, handle customer security communications, and maintain audit-ready records for market surveillance authorities.	IEC 62443 lifecycle maintenance, patch management, issue handling, and security guidance practices.	Post-market surveillance file, vulnerability and update history, customer notification records, evidence retention register, and change impact assessments.

A practical implementation sequence should start with product classification and vulnerability reporting readiness, because these determine the compliance route and near-term operational obligations. Manufacturers should then strengthen IEC 62443-based secure development and technical control evidence before consolidating everything into CRA-ready conformity documentation, user information, CE marking evidence, and post-market surveillance records.

Conclusion

The Cyber Resilience Act marks a significant shift in how cybersecurity is regulated for digital products in the European market. It moves cybersecurity from a voluntary best practice or customer expectation into a mandatory product compliance requirement linked to market access, CE marking, lifecycle support, vulnerability handling, and regulatory accountability.

IEC 62443 provides one of the strongest foundations for manufacturers seeking CRA readiness, particularly for industrial products, embedded systems, software components, and OT environments. Its strengths in secure development, technical security requirements, security risk assessment, patch management, and lifecycle governance make it a practical and credible framework for demonstrating many of the CRA’s cybersecurity expectations.

However, IEC 62443 should be used as the technical backbone rather than the complete compliance answer. Manufacturers must supplement it with a CRA-specific layer covering product classification, conformity assessment, technical documentation, CE marking, EU declaration of conformity, vulnerability reporting, user information, support commitments, economic operator obligations, and post-market surveillance evidence.

The most effective approach is therefore to map CRA obligations directly to existing IEC 62443 controls and evidence, identify regulatory gaps, and build an integrated compliance roadmap before the main CRA obligations apply. Organizations that begin this alignment early will be better positioned to reduce redesign effort, strengthen product assurance, support conformity assessment, and maintain trusted access to the EU market.

Sources

• European Commission, Cyber Resilience Act policy overview and summary pages.

• Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements.

• ENISA, Cyber Resilience Act requirements standards mapping.

• European Commission Joint Research Centre, cybersecurity standards and CRA-related standards mapping work.

• ISA/IEC 62443 series materials and IEC guidance on IEC 62443 for industrial automation and control systems.

• DLA Piper, Cyber Resilience Act implementation and compliance overview.

• Cyber Resilience Act explanatory resources on product classification and conformity implications. 

Looking for a solution tailored to your unique challenges? Gira Group provides expert consultation and specialized training designed to drive results. Let’s work together - reach out to our team or learn more about our services at www.gira.group.