The Cyber Resilience Act introduces new requirements for connected digital products. Leuze addresses these requirements through systematic threat analysis, secure sensor architectures, authenticated access and security updates throughout the planned product lifecycle.

In 2024, the EU enacted the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, a cybersecurity regulation that applies in phases. Since 11 September 2026, manufacturers of products with digital elements have been required to report serious security incidents and actively exploited vulnerabilities via a central EU platform, the Single Reporting Platform.

In January 2027, the new Machinery Regulation (EU) 2023/1230 will take effect, setting specific requirements for cybersecurity and digital safety components. From December 2027, all new digital products placed on the market must comply with the CRA. For manufacturers, this means assessing and documenting cyber risks, establishing a secure development lifecycle and bringing to market only products that are protected against cyberattacks in line with the current state of the art.

Cybersecurity for connected industrial systems

This is particularly important for industrial automation, where legacy systems often operate alongside modern digital systems. As machinery and control systems usually remain in use for many years, vulnerabilities can persist for a long time. At the same time, as connectivity increases, so does the attack surface. Even minor security vulnerabilities can result in production downtime or the loss of sensitive operational data.

The CRA is designed to ensure the security of devices with digital components, including many Leuze sensors, during development and operation and throughout the product lifecycle. An important factor here is the ability to receive updates. The CRA requires that security updates be technically feasible and that manufacturers make them available as needed. Users thus benefit from products that are developed, operated and supported in accordance with the latest security standards.

How manufacturers implement the requirements

Leuze began integrating the CRA’s requirements into its development and production processes at an early stage. The company’s many years of expertise in workplace safety and personal protection helped it develop security processes to protect systems and networks against external attacks. Both fields require comparable strategies and processes. The cornerstones of implementation are:

  • Security by design: Digital products are developed in line with the current state of the art in cybersecurity. Leuze has strengthened its sensor architecture with features including secure boot and secure file systems. On start-up, security features in the device hardware validate and verify the software being loaded. Data on the sensors is protected against tampering, and the system architecture enables encrypted data transmission over the sensors’ communication channels.
  • Security by default: Factory settings are secure by default, and all optional interfaces are disabled. All user access must be authenticated. Sensors can be reset to factory settings at any time, and customer-specific data can be deleted.
  • Update capability: Digital products can receive security updates while in service. Where appropriate, updates can be installed via the process interface. If an update fails, the system reverts to the previous secure state.

Cyber Resilience Act: security as an integral part of our sensors

How the CRA is changing product development

Security considerations are incorporated into every phase of development for new sensors. This includes:

  • Systematic threat analysis: Leuze uses a risk matrix to assess potential attack scenarios.
  • Minimising attack surfaces: Strict security requirements are incorporated from the start of product development.
  • Providing security updates: Leuze defines product lifecycles that determine how long each sensor is supported and how it is succeeded. Customers receive regular updates throughout the products’ planned service life to maintain functionality and address identified vulnerabilities. Leuze is also developing ways to update all its products within a system at the same time.
  • Documentation: Leuze prepares comprehensive documentation for each product to help customers use it safely.
  • Vulnerability management and reporting: Leuze has established processes to identify and manage vulnerabilities and report incidents promptly within the timeframes specified in the CRA.

How Leuze supports CRA implementation

Leuze guides users through the transition period until the CRA is fully implemented. The sensor manufacturer provides information on the requirements and shares best practice. Customers receive guidance on everything from selecting suitable products to integrating them safely into existing systems. Services include:

  • Tailored consultation: Experts are on hand to help customers evaluate their systems and components.
  • Application recommendations: Leuze provides specific guidance on how to operate sensors and control systems safely.
  • Documentation support: Customers receive assistance in preparing the necessary technical documentation.
  • Information on reporting procedures: Leuze explains how to report security incidents and what steps to take in an emergency.

Read other recent news: https://industrial-compliance.co.uk/category/news/