Technical Paper Abstract
The European Union Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for products with digital elements that are placed on the European market. For manufacturers of industrial communication products and EtherNet/IP devices in particular, compliance is not only a regulatory obligation but also a practical necessity for reducing operational risk, protecting customer production environments, and preserving market access.
This paper provides a practical manufacturer-oriented approach to how to achieve CRA compliance and continue to deliver existing products into the EU market. It explains how CRA obligations intersect with industrial automation, secure industrial communication, IEC 62443, and product lifecycle management. It also proposes a step-by-step method for moving from product scoping to security context definition, threat analysis, risk assessment, countermeasure selection, documentation, and post-market vulnerability management.
The central argument is that CRA compliance should not be treated as a purely legal exercise. It should be used as a structured engineering discipline that strengthens product security, improves operational resilience, and creates clearer evidence for audits, customers, and internal development teams.
Keywords
Cyber Resilience Act (CRA), products with digital elements (PwDE), industrial automation and control systems (IACS), EtherNet/IP, CIP Security, IEC 62443, secure-by-design, threat analysis and risk assessment (TARA), software bill of materials (SBOM), vulnerability management, lifecycle security, CE conformity assessment
Paper and presentation from the 2026 ODVA Industry Conference & 24th Annual Meeting: to be published November 2
Sven Giesecke, Director Portfolio, CodeWrights GmbH
Andreas Winter, CySec Specialist, CodeWrights GmbH