What Does the CRA Ask of OEMs?
The CRA calls for security through every stage: Design, deploy, execute and maintain. If you take it down to its essential element, it comes to three questions. Answer them honestly and you know where you stand.
Question 1: Is Your Organization Secure?
Not just your products, your organization. Can you service your market, provide support and operate at a standard you'd be willing to stand behind?
The easiest way to think about it is your cybersecurity culture. Is cybersecurity part of your organization the way safety became part of the manufacturing culture 15-20 years ago?
Question 2: Is What You Ship Secure by Design and Default?
These are two industry terms that are worth keeping straight. This is where OEMs need to be able to demonstrate that cybersecurity was considered throughout the design and development process allowing CE Markings and meeting IEC 62443 compliance.
Secure by Design = How the Machine Is Built
This includes how it's designed, how it's connected, how people connect to it physically or remotely.
Secure by Default = the State It Ships In
This means it's built with the least amount of unnecessary things and the fewest hooks. The machines aren't wide open and waiting for someone downstream to lock it down.
Question 3: Can You Provide Ongoing Support and Updates?
This one is mandated. It's also the one OEMs most consistently underestimate.
You can verify your product is free from viruses the day you ship it but how will you track new and emerging vulnerabilities over time? Vulnerabilities usually surface after an attacker gets their hands on versions of that equipment and looks for ways in.
What this means is your posture needs to be always-on. You know what you've sold and what the threat intelligence and vulnerability reports are telling you about it. And now you have a duty to help the customers you sold the machine to. Or it could create further issues.
The Math Most OEMs Haven't Done
Here's the other thing you need to note from question three: This obligation follows the machine for product lifetime or up to 10 years while it's in production.
Hypothetical example: Your OEM ships a hundred machines a year. By the time you hit the ten-year window, you're carrying 1,000 machines under active obligation. And each with a number of installed devices. Let’s say 100 such devices. This means you have to be able to track vulnerabilities and product updates mapped to over 100,000 end points you have shipped to multiple locations. All in a thousand machines whose versions and vulnerability status you're expected to know, track and report on.
Next, add the cost in labor. It scales with your size and is not trivial. OEMs in Europe who are navigating this tell us the tracking burden is immense; and those who have found a way to simplify it experienced major time savings.
The Choice Facing OEMs
This kind of workload sets up a tough decision. You can take this as status quo and integrate it as part of the core capability of your product, function and service. Or you can treat it as a nuisance with a checkbox and put it behind you.
The second path is where the problems show up. Make no mistake, the CRA is going to change the OEM market. The question is which side of that change you're on.
A Warning to North American OEM Manufacturers
It's tempting for North American OEMs and machine builders to file the CRA as a "European problem." But it's important to watch the trajectory.
If you sell into Europe, or have customers who do, the requirement reaches you through the purchase order.
If you're strictly North American based, the federal government has already started to increase cybersecurity requirements across industries and government sectors, which suggests that requirement will continue to expand into other industries. Whether or not it arrives on a fixed timeline, the direction is not toward less accountability.
