The Cyber Resilience Act –get CRA ready with Bachmann
Digital products must be CRA compliant from December 2027. Bachmann delivers the certified foundation.
With the Cyber Resilience Act, the European Union is establishing mandatory cybersecurity requirements for products containing digital elements. This also includes machines and automation solutions equipped with controllers, network interfaces, remote maintenance access, or cloud connections. Consequently, cybersecurity is shifting from a competitive advantage to a legal obligation.
- September 11, 2026: Mandatory reporting of actively exploited vulnerabilities and serious security incidents
- December 11, 2027: Full implementation of the Cyber Resilience Act
- Manufacturers of machines and equipment with digital components
- Manufacturers of software and automation solutions
- Integrators who develop their own products based on components
- Security by design and security by default
- Risk assessment during development
- Vulnerability management throughout the entire product lifecycle
- Security documentation for users
- Security updates during the defined support period
- Documentation and verification of implemented security measures
- Message about actively exploited vulnerabilities
- What matters is not when a product was developed, but when it is made available on the European market.
- Even existing product lines that continue to be sold after December 11, 2027, must meet the requirements.
Security you can count on.
We support you on your path to CRA compliance with certified products, security features and clear processes.
Secure development processes since 2024
M200 automation components
In industrial automation
Support throughout the entire life cycle
Having a secure controller does not make your machine CRA-compliant.
The use of a controller developed in accordance with IEC 62443 is an important component – but it does not constitute the entire proof of compliance. The responsibility for the end product’s compliance remains with the machine manufacturer. That is precisely why we clearly outline what we provide and what remains your responsibility.
Here's what Bachmann offers | Here's what remains your responsibility |
|
|
You don't have to start from scratch.
Those who rely on components that have already been developed in accordance with IEC 62443-4-1 and 4-2 can significantly reduce the effort required for implementation and compliance documentation.
What you can expect from us.
The CRA affects the entire supply chain. As a component manufacturer, we lay the foundation on which you can build your own compliance.
Our controllers are developed in accordance with established security standards. Security is an integral part of product development, not an afterthought.
Encrypted communication, role-based access rights, Secure Boot, secure updates, and end-to-end security logging – all integrated, not just tacked on.
Security updates throughout the defined support period in full accordance with CRA requirements
Certification records, security documentation, and information on vulnerabilities – as a basis for your own documentation.
Security at every layer – from communication to application
The CRA does not require a single security feature, but a holistic approach to protection. At Bachmann, protection is based on the principle of defense in depth: coordinated protection and hardening measures across different levels of the control system increase resilience and limit the impact of an attack.
