What is a System Summary?

A list of important details about the machine that must be shipped with the machine, including software components, hardware specifics and an attestation/report that the current configuration is free of any known vulnerabilities and has no needs related to patching.

What does Rockwell offer for NIS2?

SecureOT Platform gathers detailed, asset-related security information while also enabling remediation, allowing OEMs to move beyond simply identifying risks to actively managing and taking informed action that closes gaps and strengthens defenses. To support with NIS2 requirements, Rockwell Automation offers a wide range of services: Strategic Advisory, providing compliance and readiness assessments to understand current steps and actions to achieve compliance Specific OT Cybersecurity Policy and Procedures, Risk Assessments and Cybersecurity Training that help mitigate compliance gaps Products and software that meet requirements around encryption, such as CIP Security, FT Policy Manager & FT Security

Is Rockwell acting as a regulatory auditor?

No, Rockwell provides data, reports and visibility, but is not a formal CRA or machine regulation auditing authority.

Will licenses transfer from OEM to end user?

No. The license will remain with the OEM.

OEM Cybersecurity Compliance Readiness

New regulations are raising the bar for product security & lifecycle support.

Schedule a Consultation

industry 4.0, Factory Industrial Engineer working with automation robot arms machine in intelligent factory, generative ai

Cybersecurity

Cybersecurity is rapidly becoming a core requirement for doing business, selling products and meeting regulatory obligations for Original Equipment Manufacturers (OEMs). New regulations, including the Cyber Resilience Act (CRA) and Machinery Regulation (MR), are introducing stricter requirements around secure product development, vulnerability management, software maintenance, incident reporting and cybersecurity throughout the equipment lifecycle.

By taking a proactive approach, OEMs can reduce risk and build customer trust while streamlining purchasing and approval processes and gaining a competitive advantage in a market where cybersecurity expectations continue to grow.

What Do These Regulations Mean for OEMs?

Meeting these requirements mandates shared accountability across the industrial ecosystem including manufacturers, machine builders, software providers and end users. For OEMs, compliance is no longer just about protecting your own business systems. It's increasingly about showing customers, regulators and partners that your machines, software and connected products are built and supported with cybersecurity in mind.

Cyber Resilience Act

The CRA establishes mandatory, lifecycle-wide cybersecurity regulations for all manufacturers, importers and distributors offering Products with Digital Elements (PDEs) containing connected hardware, software, embedded components and remote data processing solutions. OEMs must implement secure-by-design practices, ship systems free from risk or vulnerabilities, and maintain processes for reporting evolving cybersecurity risk. Emerging CRA regulations apply to OEMs whether they are building within or shipping to the EU. Reporting requirements for the CRA will begin in September 2026, with full compliance required by December 2027.

Machinery Regulation

The new Machinery Regulation integrates cybersecurity into machinery safety and conformity requirements, expanding expectations for machine builders and equipment manufacturers. The regulation emphasizes that cybersecurity must be considered throughout machine planning, design, development, production, delivery and maintenance phase, thereby helping ensure that machinery remains safe and resilient in increasingly connected industrial environments. Full compliance with the Machinery Regulation will be required in January 2027.

SecureOT Offers OEMs A Compliance-Ready Cybersecurity Program

SecureOT™ offerings specifically for OEMs help strengthen cybersecurity readiness, integrate secure-by-design practices, support compliance readiness and continuously monitor machine cybersecurity risk.

Key differentiators of SecureOT capabilities for OEMs

Gain visibility into cybersecurity risks, vulnerabilities and compliance gaps across products, systems and operations. SecureOT assessment services provide a system-specific roadmap to address deficiencies and accelerate secure by design delivery.

Capabilities include:

Cybersecurity maturity assessments
Machine-level risk and vulnerability assessments
Architecture and security reviews
Compliance readiness evaluations
OT asset discovery and inventory

Strengthen cybersecurity posture, reduce audit burden and align with evolving regulatory expectations with strategic guidance and hands-on execution from cybersecurity experts who understand industrial environments and OEM operations.

Capabilities include:

CRA and MR regulatory and compliance readiness
Cybersecurity strategy and program development
Establish policies and procedures to support audits and ongoing regulatory obligations

As cybersecurity regulations continue to evolve, OEMs need a more efficient way to manage machine cybersecurity information throughout the product lifecycle.

Specifically built for OT environments, SecureOT™ Platform gives OEMs a more structured and scalable approach to cybersecurity, helping simplify documentation, support compliance readiness and continuously identify and document cyber risks across deployed assets.

Key capabilities:

System summaries and machine hardware and software inventory reporting
Vulnerability and patch tracking
Ongoing risk monitoring
Compliance-ready reporting and recordkeeping

Before machine delivery	After machine delivery
Build a complete cybersecurity System Summary including: Software inventory aligned to CRA requirements Hardware inventory, firmware versions, and component details Known vulnerabilities, exposures, and associated risk status Documentation demonstrating cybersecurity due diligence and secure-by-design practices	Maintain security throughout the machine lifecycle: Monitor newly disclosed vulnerabilities and product advisories Assess impact across deployed machines Track security updates Support customer reporting and regulatory obligations

Before machine delivery

After machine delivery

Build a complete cybersecurity System Summary including:

Software inventory aligned to CRA requirements
Hardware inventory, firmware versions, and component details
Known vulnerabilities, exposures, and associated risk status
Documentation demonstrating cybersecurity due diligence and secure-by-design practices

Maintain security throughout the machine lifecycle:

Monitor newly disclosed vulnerabilities and product advisories
Assess impact across deployed machines
Track security updates
Support customer reporting and regulatory obligations

Business Outcomes OEMs Can Achieve with SecureOT

SecureOT for OEMs helps machine builders streamline CRA readiness with machine-level visibility, prioritized remediation and compliance reporting to support secure-by-design products and achieve these business outcomes:

Minimize engineering effort and compliance burdens while simplifying regulatory documentation.

Increase risk visibility, enable informed decisions and uncover security gaps.

Build customer trust, strengthen differentiation and boost confidence in machine security.

Accelerate compliance readiness, prioritize risks and scale cybersecurity improvements.

Reduce machine and operational vulnerability, improve resilience and support business growth.

Rockwell's SecureOT™ Portfolio Offerings

CRA & Machinery Regulation Overview

MACHINE BUILDER OBLIGATION

ROCKWELL OFFERING

Documentation and Compliance

Machine Builder Obligation

Vendors shall provide risk assessment documentation describing how cybersecurity risks were considered and mitigated during development, including technical documentation, cybersecurity measures, and SBOMs.

Rockwell offering

Rockwell’s SecureOT portfolio provides a range of software and services that range from assessing secure development/design principles, assessing machine build standards as well as scanning and documentation of as-built equipment over time.

Secure by Design

Machine Builder Obligation

Products must be made available on the market with a secure by default configuration, unless otherwise agreed between manufacturer and business user.

Rockwell offering

Rockwell’s core product line provides certified secure products (to 4-1 maturity level 4, 4-2 product certification) for use in designing machine components. Coupled with our security consulting, we can help assess the security of the entire machine from hardware to communications and on.

Data Confidentiality

Machine Builder Obligation

Protect the confidentiality and integrity of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state‑of‑the‑art mechanisms.

Rockwell offering

CIP Security protects data in transit and increased device security capabilities such as encryption of data-in-rest within the controller protects the customer’s IP. This is a core feature of Rockwell products and is a key component of our services and software checks for during design and system summary stages.

Data Integrity

Machine Builder Obligation

CIP Security protects data in transit and increased device security capabilities such as encryption of data-in-rest within the controller protects the customer’s IP. This is a core feature of Rockwell products and is a key component of our services and software checks for during design and system summary stages.

Rockwell offering

Expanding footprint of products supporting CIP Security or other Secure Communications will enable products from software to device layer to communicate securely with integrity and authenticity.

Vulnerability Management and Updates

Machine Builder Obligation

Ensure protection from unauthorized access through appropriate control mechanisms, while implementing processes to identify, assess, remediate, and patch vulnerabilities throughout the lifecycle.

Rockwell offering

Device Security and System Hardening can be used together with change detection, configuration compliance and contextualized Risk visibility within SecureOT™ Platform.

Event Logging

Machine Builder Obligation

Provide security‑related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt‑out mechanism for the user.

Rockwell offering

SecureOT Platform can provide centralised log ingestion and analysis. More devices will support the use of Syslog to provide the foundation to track both intended and unintended events.

Vulnerability Reporting

Machine Builder Obligation

Reporting obligations for exploited vulnerabilities and security incidents, i.e. 24 hour initial reporting windows.

Rockwell offering

Enhanced transparency is an important aspect of the regulations. SecureOT Platform can provide Vulnerability Mapping and remediation capability.

Moving forward, CRA sets the requirement for OEMs to demonstrate that connected machines, control systems and digital products are designed and supported with industrial cybersecurity built in. By proactively investing in cybersecurity capabilities, processes and documentation, OEMs can differentiate their offerings, build stronger customer relationships and capitalize on growing demand for secure, connected products to meet customer demands and maintain trusted relationships.

Read the blog

Why OEMs Partner With Rockwell Automation for Cybersecurity

OEMs require cybersecurity partners who understand both industrial operations and the realities of machine building. SecureOT™ offerings from Rockwell Automation combine industrial cybersecurity expertise, advisory services and SecureOT™ Platform to help OEMs confidently navigate today's regulatory environment while preparing for tomorrow's requirements.

Industrial Expertise

Decades of experience helping manufacturers, machine builders and industrial organizations secure critical operations.

End-to-End Portfolio

From assessments and advisory services through implementation and ongoing monitoring, Rockwell Automation helps develop comprehensive cybersecurity programs for long-term effectiveness.

OT-Focused Approach

Built on decades of cybersecurity expertise but grounded in over 100 years of industrial automation and manufacturing development, we help clients provide IT type protection in complex OT environments.

Secure by Design

Establish cybersecurity as a built-in part of machine design, deployment and lifecycle management. SecureOT™ Platform delivers the visibility and context needed to reduce risk, achieve compliance obligations and maintain operational integrity without interrupting production.

Scalable Programmatic Security

A measurable, repeatable approach that enables OEMs to systematically build and scale cybersecurity capabilities while supporting business growth and regulatory compliance.

Regulatory Alignment

Support for helping organizations address requirements associated with industry standards and emerging regulations, including IEC 62443, CRA and the Machinery Regulation.

Building On An Established Security Infrastructure

Rockwell Automation helps OEMs address evolving cybersecurity and compliance requirements by building on a foundation of certified practices and embedded security capabilities.

1. IEC 62443 Certified Foundation

Building cybersecurity into products, development processes and industrial solutions.

IEC 62443-4-1 - Secure Development Lifecycle certified at Maturity Level 4
IEC 62443-4-2 - Product certification by third-party TUV Rheinland
IEC 62443-3-3 - Industry system solution
IEC 62443-2-4 - Certified Industrial Security Services
IEC 62443-2-4 – Industry's first plant-wide IEC 62443 certification

2. CIP Security

Product communications and device trust.

Authentication – helps prevent unauthorized device from establishing connections
Integrity – helps prevent tampering or modification of communications
Confidentiality – helps prevents snooping or disclosure of data

3. FactoryTalk Policy Manager (FTPM)

Centralized security administration and policy management.

System management – easily create and deploy security policies
Micro-segmentation – segment your automation application into smaller zones
Device-based firewall – restrict backplane access and bridging via the security policy

4. Access Control & Logging

Control user privileges and strengthen communications.

Role-based access control – extension of CIP Security providing user-defined privileges
CIP Security – expand portfolio adoption of the CIP Security Technology
Logging – continue to expand the Syslog infrastructure

5. CRA & Machinery Regulation Readiness

Security capabilities designed to support emerging OEM requirements.

Secure by default – products have Secure Boot, signed FW, RBAC (when available), along with CIP security technology
Encrypted data storage – store application code securely on controllers
Secure system time – securing PTP to ensure system coordination

Take the Next Step Toward Cyber Resilience

OEMs Can’t Afford to Not Embrace Cybersecurity

Blog

OEMs Can’t Afford to Not Embrace Cybersecurity

OEMs who embrace OT cybersecurity and incorporate it into their end-to-end offering will help grow their services and achieve compliance.

Read Now

Cybersecurity Preparedness Assessment

It’s not a question of if your business will be subjected to a cybercrime, it’s when. Take this quiz to evaluate your cybersecurity preparedness.

Take the Assessment

Industrial OT Cybersecurity – Rockwell Automation SecureOT

Industrial zone,The equipment of oil refining,Close-up of industrial pipelines of an oil-refinery plant,Detail of oil pipeline with valves in large oil refinery.

Industrial OT Cybersecurity – Rockwell Automation SecureOT

SecureOT combines OT‑specific designed software, expert services, and global scale to reduce risk, improve uptime, and simplify compliance for industrial operations.

Schedule a Consultation

FAQs

Certification of our company standards
Product Development IEC 62443-4-1	Systems Delivery IEC 62443-2-4

Certification of our company standards

Product Development

IEC 62443-4-1

Systems Delivery

IEC 62443-2-4

Certification of our offering
Product Capability IEC 62443-4-2	Info Security ISO 27001	Cloud Security SOC2 Type 2	Cloud Security CSA STAR	Cloud Security ISO 27017
OS Hardening Compatibility CIS Certification	US Executive Order – NIST 800-218 Secure Software Development Framework

Certification of our offering

Product Capability

IEC 62443-4-2

Info Security

ISO 27001

Cloud Security

SOC2 Type 2

Cloud Security

CSA STAR

Cloud Security

ISO 27017

OS Hardening Compatibility

CIS Certification

US Executive Order – NIST 800-218

Secure Software Development Framework

SecureOT Platform gathers detailed, asset-related security information while also enabling remediation, allowing OEMs to move beyond simply identifying risks to actively managing and taking informed action that closes gaps and strengthens defenses. To support with NIS2 requirements, Rockwell Automation offers a wide range of services:

Strategic Advisory, providing compliance and readiness assessments to understand current steps and actions to achieve compliance
Specific OT Cybersecurity Policy and Procedures, Risk Assessments and Cybersecurity Training that help mitigate compliance gaps
Products and software that meet requirements around encryption, such as CIP Security, FT Policy Manager & FT Security

The current version of the CRA states that an SBOM is met by having a listing of all firmware, software, versions, vulnerabilities and assets of the machines. This is delivered to our SOTP users with current ‘off the shelf’ capabilities. The more commonly known term SBOM in the marketplace is actually meaning the list of software AND all of the libraries, binaries, and dependencies WITHIN the software. This is not a current requirement of CRA but is being monitored by RA should we need to adjust our offering for future regulatory requirements.

Schedule a Consultation

Partner with our experts to define a roadmap aligned to your manufacturing operations, risk priorities, and budget goals.

Talk to an OT Security Specialist

Others also viewed

Based on your activity