Future-Proof Machines Start with Cyber-Secure Components

The Cyber Resilience Act (CRA EU 2024/2847) introduces mandatory cybersecurity requirements for products with digital elements. Its objective is to ensure that products are securely developed, operated, maintained, and supported throughout their entire lifecycle. 

For machine builders, cybersecurity therefore becomes an integral part of product development, risk assessment, and supplier management. 

Most modern machines today contain digital components such as: 

• Sensors and actuators 

• IO-Link devices and IO-Link masters 

• Fieldbus and Ethernet components 

• Camera systems 

• Embedded software and firmware 

• Industrial PCs 

As a result, many machines fall within the scope of the CRA. In addition, every machine builder must take the cybersecurity risks of integrated components into account as part of their duty of care. 

A machine typically falls under the CRA if, cumulatively: 

• It contains digital elements. 

• It is made available on the EU market. 

• It exchanges data directly or indirectly with other devices or networks. 

Even an indirect connection is sufficient, for example, through Ethernet, PROFINET, PROFIBUS, USB, Wi-Fi, Bluetooth, NFC, remote maintenance systems, industrial PCs, or gateways. A direct Internet connection is not required. 

If a machine processes, stores or transmits data, the CRA is likely to apply.

No. At the time this document was last updated, there is generally no requirement to replace machines that are already installed.

The CRA primarily applies to products with digital elements that are newly placed on the market after the introduction of the CRA or that undergo substantial modifications after that date.

Since the CRA will only become fully applicable on 11 December 2027, no manufacturer can currently declare formal CRA-conformity for products. 

We therefore use the term "CRA-Ready" for products where, for example:

• A cybersecurity risk assessment has been conducted 

• Security requirements aligned with IEC 62443 have been implemented 

• Security updates are planned and supported 

• Structured documentation for secure integration is available 

• Future CRA requirements have already been considered 

• A Product Security Incident Response Team (PSIRT) is available as a point of contact for vulnerability reporting 

The CRA-Ready products we provide already establish the foundation for long-term secure integration. This reduces the effort required for risk assessments, supplier audits, and future compliance documentation. 

No, it does not. The machine builder remains the manufacturer of the overall system and is responsible for assessing the cybersecurity risks of the complete machine in its entirety, even when integrating CRA-Ready products. This responsibility also remains when using formally CRA-compliant products.

CRA-Ready products, and later CRA-compliant products, support machine manufacturers because of suppliers such as Balluff: 

• Implement security requirements for their products 

• Monitor vulnerabilities 

• Provide security updates 

• Document relevant security information 

This information can be used as part of the machine's cybersecurity risk assessment and technical documentation. 

The CRA follows a risk-based approach. Not every product requires the same security features. 

The required measures depend on several factors including:

• Product functionality 

• Degree of connectivity 

• Operating environment 

• Expected service life 

• Potential impact of a cyberattack 

Therefore, an IO-Link sensor requires different security measures than an IO-Link master, a smart camera, or software. 

Security measures are determined based on a cybersecurity risk assessment. 

The CRA and the Machinery Regulation (which replaces the Machinery Directive 2006/42/EC on 20 January 2027) pursue different objectives but complement each other. 

Many cybersecurity measures also support compliance with Machinery Regulation requirements. 

Examples include: 

• Protection of control systems 

• Software integrity 

• Protection against tampering 

• Secure communications 

However, compliance with the CRA does not automatically ensure compliance with the Machinery Regulation. 

When a vulnerability becomes known, Balluff will communicate available mitigations and updates via CERT@VDE 

As a machine builder, plant manufacturer, or system integrator, you must assess whether vulnerability is exploitable within the specific application and determine if additional protective measures are required. 

Responsibility for the overall machine remains with the machine manufacturer, at any time.

Balluff supports customers through: 

• Vulnerability information (Security Advisories in CSAF format via CERT@VDE) 

• Security updates provided through the Balluff update platform 

• PSIRT contact options 

• A coordinated vulnerability disclosure process 

All information about the Balluff PSIRT and how to report vulnerabilities can be found here: Secure. Transparent. Reliable: Product Security at Balluff

If you identify vulnerability in one of our products or software products during testing, a security audit, or by any other means, and that vulnerability affects your machine or system, please report it directly to our Product Security Incident Response Team.

By reporting the vulnerability to our PSIRT, you enable: 

• A confidential assessment of the issue 

• Coordination of potential remediation measures 

• Provision of security information and updates 

• Responsible and coordinated vulnerability handling 

Both regulations contribute to strengthening the cybersecurity of products, machinery, and infrastructure. However, they address different areas of cybersecurity.