Question 1

Who does the Cyber Resilience Act apply to for integrators and plant builders?

Accepted Answer

The CRA applies to products with digital elements placed on the EU market — in plant engineering, that means controllers, networked components and the installation as a whole system with a software share. Any integrator or plant builder who integrates third-party components and places them on the market under their own name is considered a manufacturer under the CRA and carries its obligations.

Question 2

When do the CRA reporting obligations apply to integrators and plant builders?

Accepted Answer

The reporting obligations of the Cyber Resilience Act (CRA) apply from 11 September 2026. From that date, manufacturers — including integrators and plant builders — must report actively exploited vulnerabilities and severe security incidents to the competent national authority (CSIRT) and to ENISA. The remaining CRA requirements apply in full from 11 December 2027.

Question 3

What has to be reported within 24 hours?

Accepted Answer

The fixed deadlines apply towards the authorities: via ENISA's single reporting platform, an actively exploited vulnerability or a severe security incident requires an early warning to the coordinating CSIRT and ENISA within 24 hours of becoming aware, a more detailed notification within 72 hours, and a final report later on. Affected users, by contrast, are informed not on an hourly deadline but "without undue delay" about the vulnerability or incident and any countermeasures. For integrators and plant builders with hundreds of components per installation, neither is realistic without automated vulnerability management.

Question 4

What is an SBOM — and why does a plant builder need one?

Accepted Answer

An SBOM (Software Bill of Materials) is a complete inventory of all software components of a product. The CRA requires manufacturers to know and document their components. For plant builders, the SBOM is the basis for instantly identifying which installations are affected when a vulnerability is reported.

Question 5

How does supplier vulnerability monitoring work?

Accepted Answer

Werkspilot continuously monitors your suppliers' security advisories — structured CSAF feeds as well as mailing lists, RSS or unstructured emails. Every new vulnerability is automatically matched against your installations in the field, so you immediately see which installations are affected. This continuous monitoring produces one central, normalized overview instead of scattered individual alerts.

Question 6

What is CSAF — and what role does it play in monitoring?

Accepted Answer

CSAF (Common Security Advisory Framework) is a machine-readable standard format for security advisories, increasingly used by manufacturers and authorities such as the German BSI and the US CISA. Machine-readable CSAF feeds can be processed automatically — the basis for monitoring supplier vulnerabilities without manual research and immediately mapping them to affected installations.

Question 7

How long do security updates have to be provided under the CRA?

Accepted Answer

Manufacturers must handle vulnerabilities and provide security updates throughout the support period — at least five years, unless the product's expected lifetime is shorter. For long-lived industrial installations this period can be correspondingly longer.

Question 8

What penalties apply for CRA violations?

Accepted Answer

For violations of the essential cybersecurity requirements, the CRA provides for fines of up to €15 million or 2.5% of worldwide annual turnover — whichever is higher. That alone is reason for integrators and plant builders to establish vulnerability and reporting processes early.

Question 9

How are the Cyber Resilience Act and the Machinery Regulation connected?

Accepted Answer

The EU Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and contains its own cybersecurity requirements. The CRA and the Machinery Regulation interlock: meeting the CRA requirements for vulnerability handling, SBOM and security by design covers essential cybersecurity duties of the Machinery Regulation. The IEC 62443 standard series serves as technical guidance.

Question 10

What is a STRIDE threat analysis and when do I need one?

Accepted Answer

STRIDE is a structured threat-modelling method (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). For the risk assessment of an installation under the Machinery Regulation and CRA, a STRIDE analysis systematically identifies attack points at the interfaces and derives protective measures. We produce STRIDE risk assessments for installations as the basis for auditable security documentation.

Question 11

How does Werkspilot help with vulnerability management across the supply chain?

Accepted Answer

Werkspilot captures all supplier advisories — from CSAF to email — centrally, automatically identifies the affected installations and lets you forward an assessed report to your customers on time. This way you fulfil the CRA reporting chain across hundreds of components and installations without manually checking every feed.

CRA vulnerability management for integrators and plant builders — across the entire supply chain.

Under the CRA, actively exploited supplier vulnerabilities must be passed on within 24 hours.

From supplier advisory to customer report in a single platform.

STRIDE threat analysis of your installations for CRA and the Machinery Regulation.

Articles on the CRA and the Machinery Regulation.

CRA reporting obligation from September 2026: Which machines are affected?

CRA and the Machinery Regulation for integrators and plant builders: what applies from 2026

Frequently asked questions on the CRA, the Machinery Regulation and vulnerability management for integrators and plant builders.

Book a call.