In the most recent webinar from the ISA Global Cybersecurity Alliance (ISAGCA), “Routes for Complying with the EU CRA and the Importance of Risk Assessment,” Michael Medoff, director of certification for exida LLC., presented ways manufacturers can prepare to be compliant with the European Union’s Cyber Resilience Act. Risk assessment is at the top of the list.
A little background
The European Union’s Cyber Resilience Act (CRA) will fully go into effect on 11 December 2027. The CRA will apply to any products that you intend to sell in the EU with digital elements that have a logical or physical data connection to a device or network. It could be hardware or software; the law also talks about remote data processing solutions.
Additionally, cloud-connected software that shares information with the manufacturer could be subject to CRA requirements. For example, an industrial controller installed at a manufacturing facility that communicates with its manufacturer’s cloud platform could fall within the CRA. Activities—including remote monitoring, diagnostics, software updates, and remote management—could trigger CRA obligations. We recommend referring to the EU’s CRA website to confirm the exact scope.
Being compliant on 11 December 2027
The regulation does distinguish between products already on the market (before 11 December 2027) and any products that go on the market on 11 December 2027 or after. Products already placed on the market generally are not retroactively subject to all new product requirements, although modifications to the product can trigger additional obligations and the need to be CRA compliant.
When CRA does go into effect, the EU will not prescribe a single technical approach for every product. Instead, manufacturers have several potential pathways to conformity, with cybersecurity risk assessments playing a significant role in determining which requirements are applicable.
The CRA regulation introduces obligations covering secure product development, cybersecurity capabilities, vulnerability management, technical documentation, and ongoing security support.
The world is patiently waiting for the third draft of the EN 62443 document to be released. EN 62443 is based on the ISA/IEC 62443 series of standards. As of this writing, the third draft is expected to be released in November 2026 or later, although in early 2026, October was the estimate.
Second drafts of EN 62443 4-1 and 4-2 were released for comments in late spring/early summer. If you have copies of the second draft, however, it is highly recommended that you do not use that as your final copy of the requirements. Additionally, there are plans for a revised EN 62443-3-3, but to date, no drafts have been released.
The right pathway to CRA compliance
One of Medoff’s central messages was that manufacturers have options when determining how to demonstrate conformity with CRA. The regulation establishes essential cybersecurity requirements, but manufacturers may use applicable harmonized European standards to help demonstrate that their products satisfy those obligations.
This table reflects the status and availability of relevant standards as of October 2026.
Once a standard is formally harmonized and its reference is published in the Official Journal of the EU, conformity with its applicable provisions can provide a presumption of conformity with the corresponding CRA requirements.
There will also be product-specific vertical standards. These will be standards developed for certain product categories, including routers, switches, operating systems, and other technologies. Because they address the characteristics of specific products, they may offer a more tailored approach to demonstrating compliance.
There will also be the EN 40000 series. It is being developed specifically to support CRA compliance and has the potential to provide another pathway. The EN 40000 series will address some of the same cybersecurity principles, but they are not specific to industrial automation and control systems.
Manufacturers may also demonstrate conformity directly against the CRA essential requirements where permitted by the applicable conformity assessment procedure. The requirements are relatively high-level, however, which can make demonstrating compliance more challenging.
Medoff discussed a practical combination approach: evaluating products against developing European standards while simultaneously reviewing the CRA’s essential requirements. By using this approach, manufacturers can make progress before the harmonization process is complete, while reducing the risk of overlooking regulatory obligations.
How ISA/IEC 62443 provides a foundation
For industrial automation suppliers already following ISA/IEC 62443, the transition toward CRA compliance may be much more manageable. Because the developing EN 62443 standards are built on the existing ISA/IEC 62443 international requirements, manufacturers will be able to leverage established secure development processes, technical security capabilities, and cybersecurity assessment practices.
But it is important to note that the existing compliance with ISA/IEC 62443 does not automatically establish conformity with CRA. The emerging EU versions include additional or modified requirements intended to address the regulation’s obligations.
Among the significant changes discussed during the webinar were:
- Security support periods: Manufacturers must establish appropriate support periods and maintain vulnerability management activities throughout those periods.
- Ongoing security reviews and testing: Product security responsibilities continue after development, requiring periodic evaluation of emerging threats and vulnerabilities.
- Software bills of materials (SBOMs): Manufacturers must maintain visibility into software components to support vulnerability identification and management.
- Formalized cybersecurity risk assessments: Risk analysis becomes more structured and closely connected to decisions about applicable product requirements.
- Secure-by-default configurations: Products should be delivered with appropriate secure settings and clear instructions for configurations requiring user action.
These developments reinforce an important principle: cybersecurity must be addressed throughout the product lifecycle, from initial design and development through deployment, maintenance, and the end of the security support period.
Like ISASecure’s ACSSA certification recommendations, the EU CRA recommends starting with a risk assessment
A big takeaway from the webinar is the importance of cybersecurity risk assessments in determining the requirements that would be applicable to individual products.
Within ISA/IEC 62443, security levels help define progressively stronger cybersecurity capabilities. However, Medoff explained that the developing EN 62443-4-2 does not establish a universal minimum security level, such as Security Level 2, for CRA compliance.
Instead, manufacturers must evaluate relevant requirements based on the product’s characteristics, intended use, operating environment, and associated cybersecurity risks. This could include considering higher-security-level requirements where appropriate, even when the product is not expected to implement every requirement associated with those levels.
The objective is to establish a defensible set of applicable cybersecurity requirements rather than applying the same technical controls indiscriminately to every product.
In the webinar, Medoff described a process in which manufacturers begin with a reference set of security requirements and then evaluate applicability based on product functionality, legal obligations, intended use, and cybersecurity risk. Requirements determined to be inapplicable must be supported by documented justification.
A defensible risk assessment is more than a checklist
An important distinction raised during the webinar is that manufacturers cannot simply establish their own acceptable level of cybersecurity risk and use it to justify excluding requirements.
CRA risk assessments must account for the product’s intended purpose, reasonably foreseeable use, and operational environment. Additionally, manufacturers cannot rely solely on cost or commercial feasibility to justify leaving cybersecurity risks untreated.
Medoff recommended drawing on established methodologies and recognized industry guidance rather than developing arbitrary risk acceptance criteria.
For industrial environments, relevant references include ISA/IEC 62443-3-2, which addresses security risk assessments for industrial automation and control systems, and risk assessment concepts from ISA/IEC 61511, a functional safety standard for the process industries.
Although functional safety and cybersecurity address different disciplines, established risk evaluation methods can provide useful foundations for assessing the likelihood and consequences of cybersecurity threats.
Preparing for compliance while standards continue to evolve
- Manufacturers should begin evaluating the emerging standards alongside the regulation’s essential cybersecurity requirements.
- Organizations already following ISA/IEC 62443 can assess their existing practices against the developing EN 62443 requirements, identify potential gaps, and establish plans to address them.
- Manufacturers should also evaluate whether product-specific vertical standards or other European standards offer a more appropriate conformity pathway for particular products.
- As standards are finalized and harmonized, organizations will need to revisit their assessments and update their documentation where necessary.
- Importantly, risk assessment is not a one-time activity completed before a product is placed on the market. Cybersecurity threats, vulnerabilities, and operating conditions change over time, making periodic reassessment an essential part of maintaining product security throughout the support period.
A great takeaway from Medoff came during the attendee Q&A. Someone asked what happens if you have an ISASecure CSA certification for a product? Would that help you at all?
Medoff’s answer was that ISASecure certifications may provide a head start toward CRA compliance. He estimated that suppliers already certified against ISA/IEC 62443 may be approximately 80%-90% of the way toward meeting corresponding EN requirements. However, he stressed that it is important to do your own due diligence.
Michael Medoff
Medoff is a functional safety and security expert who helps product developer clients comply with functional safety and cybersecurity standards. He was the TG Lead for the group developing ISA/IEC 62443-4-1, Secure Product Development Lifecycle Requirements, first edition. Currently, he is the co-lead of working group JT 62443-4-1, which is working on the second edition of ISA/IEC 62443-4-1, and a member of working group JT 62443-07, which is reviewing and providing feedback on EN 62443. Medoff is also one of the coauthors of Functional Safety: An IEC 61508 Certified Development Process and Implementing ISA/IEC 62443: A pragmatic Approach to Cybersecurity.
