SPS Magazine speaks with cybersecurity expert Frank Behnke from Hilscher about the Cyber Resilience Act (CRA) and its impact on the particularly affected automation and manufacturing industry: 

How do you assess the significance of the Cyber Resilience Act for the automation sector? What challenges do you see in implementing the CRA, and what role does ‘Usable Security’ play?

The CRA, the NIS2 Directive, and the NIS2UmsuCG (local German law to implement NIS 2 on national level) are of enormous importance to the automation industry. In addition to stricter security requirements, liability issues and the obligation to provide regular security updates are added. In the future, there will be no secure industrial network without deeply integrated cybersecurity. 

Opportunities lie in unified regulation and increased trust in secure products. Companies that adopt security-by-design early and follow standards such as IEC 62443 can position themselves as reliable partners in the market. Standardization will also make it easier to offer products across Europe.

The biggest challenge is the practical implementation of the new requirements. Many companies are still at the beginning of this development and underestimate the scope of the upcoming changes. Our goal is to support with expertise—without spreading unnecessary panic.

Usable Security plays a crucial role. Security mechanisms must be user-friendly and efficient. The best security is useless if it is difficult to implement or bypassed in daily operations. Systems with centralized patch management offer a competitive advantage here, as they automate security updates and reduce administrative effort.

Which specific CRA requirements are particularly relevant for machinery, plant engineering, and the process industry? How can these requirements be effectively implemented in products and processes? 

The CRA brings profound changes to product development and operations. Particularly critical is the obligation to report security incidents within 24 hours, which requires effective incident management and security monitoring. Otherwise, severe penalties may apply. 

To meet the requirements, companies must adapt their development processes by implementing security-by-design and security-by-default from the outset.

This means:

• Risk assessments and security audits already during the development phase
• Sustainable update and patch strategies to keep products secure throughout their lifecycle
• Certification compliance, as “significant changes” to existing products require re-certification 

In practice, centralized patch management systems, robust access and authentication solutions, and clearly defined processes for regular security reviews are needed. Especially for complex automation systems, it is crucial to integrate cybersecurity in a way that does not disrupt operations while reliably meeting CRA requirements.

Frank Behnke
Head of Information Systems, Hilscher

What costs and effort do you expect for implementing the CRA? Will the CRA affect the competitiveness of machinery and plant manufacturers? If so, how?

The costs and effort for implementing the CRA cannot be generalized, as they depend heavily on how early companies have integrated security-by-design into their development processes. Companies already applying secure architectural principles will face less adjustment than those just beginning to retrofit cybersecurity.

In terms of competitiveness, there is a clear divide: machines and devices that are not cyber-secure will face massive disadvantages in the market. Customers and operators will increasingly rely on certified, CRA-compliant products to minimize regulatory risks.

One example is our netX 90 communication controller, which already integrates comprehensive security mechanisms. This enables secure communication solutions to be implemented directly—a clear advantage over older chip generations that lack or only partially support such functionality.

But it’s not just products that are affected—existing network technologies must also be reconsidered. Fieldbus technologies, traditionally designed for isolated systems, are now considered inherently insecure under the new regulations and are difficult to make CRA-compliant. Companies will be forced to establish secure network architectures, such as firewall solutions, network segmentation, and strict access controls. In many cases, a complete transition to more secure, IP-based communication technologies will be necessary.

Those who adopt secure architectures, modern security mechanisms, and upgradability early will gain a clear long-term market advantage.

How do you plan to support your customers in complying with CRA requirements? What recommendations do you have for SMEs in the industry to prepare for the CRA?

Our recommendation for small and medium-sized enterprises is clear: develop a plan early to systematically address CRA requirements. Cybersecurity must be integrated into product development from the very beginning—the earlier, the better.

A key point is choosing competent security partners, as the complexity of the requirements makes isolated solutions or costly missteps uneconomical. At Hilscher, for example, we work with TÜV Rheinland and have already aligned 70% of our development processes with IEC 62443-4-1—the rest will follow shortly.

Certifications under BSI IT-Grundschutz and ISO 27001 are planned for 2025. We actively share this knowledge with our customers to help them make their products and systems secure and CRA-compliant through our expertise and technologies.

Companies should also engage in industry initiatives and working groups to exchange best practices and experiences. Several initiatives currently exist where companies network and develop joint solutions for CRA challenges. Organizations such as ZVEI, VDMA, and IEC 62443 working groups offer valuable platforms for exchange and practical support in implementing the new requirements.

Frank Behnke
Head of Information Systems, Hilscher