CRA vulnerability management for machine and plant builders — from SBOM creation to supplier monitoring.

The CRA applies to products with digital elements placed on the EU market — in machine and plant engineering, that means controllers, networked components and the installation as a whole system with a software share. Any integrator or plant builder who integrates third-party components and places them on the market under their own name is considered a manufacturer under the CRA and carries its obligations.

The reporting obligations of the Cyber Resilience Act (CRA) have applied since 11 September 2026. Since that date, manufacturers — including machine and plant builders and integrators — must report actively exploited vulnerabilities and severe security incidents to the competent national authority (CSIRT) and to ENISA. The remaining CRA requirements apply in full from 11 December 2027.

The fixed deadlines apply towards the authorities: via ENISA's single reporting platform, an actively exploited vulnerability or a severe security incident requires an early warning to the coordinating CSIRT and ENISA within 24 hours of becoming aware, a more detailed notification within 72 hours, and a final report later on. Affected users, by contrast, are informed not on an hourly deadline but "without undue delay" about the vulnerability or incident and any countermeasures. For integrators and plant builders with hundreds of components per installation, neither is realistic without automated vulnerability management.

An SBOM (Software Bill of Materials) is a complete inventory of all software components of a product. The CRA requires manufacturers to know and document their components. For plant builders, the SBOM is the basis for instantly identifying which installations are affected when a vulnerability is reported.

Werkspilot continuously monitors your suppliers' security advisories — structured CSAF feeds as well as mailing lists, RSS or unstructured emails. Every new vulnerability (CVE) is automatically matched against your installations in the field, so you immediately see which installations are affected. This continuous monitoring produces one central, normalized overview instead of scattered individual alerts.

CVE monitoring across the supply chain means: new vulnerabilities (CVEs) from your suppliers' security advisories are captured continuously and automatically matched against the components in your installations in the field. Werkspilot normalizes structured CSAF feeds as well as mailing lists, RSS and unstructured emails — because many suppliers don't publish their CVEs as CSAF. So for every new CVE you immediately see which installations are affected, instead of searching manufacturer advisories by hand.

CSAF (Common Security Advisory Framework) is a machine-readable standard format for security advisories, increasingly used by manufacturers and authorities such as the German BSI and the US CISA. Machine-readable CSAF feeds can be processed automatically — the basis for monitoring supplier vulnerabilities without manual research and immediately mapping them to affected installations.

Manufacturers must handle vulnerabilities and provide security updates throughout the support period — at least five years, unless the product's expected lifetime is shorter. For long-lived industrial installations this period can be correspondingly longer.

For violations of the essential cybersecurity requirements, the CRA provides for fines of up to €15 million or 2.5% of worldwide annual turnover — whichever is higher. That alone is reason for integrators and plant builders to establish vulnerability and reporting processes early.

The EU Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and contains its own cybersecurity requirements. The CRA and the Machinery Regulation interlock: meeting the CRA requirements for vulnerability handling, SBOM and security by design covers essential cybersecurity duties of the Machinery Regulation. The IEC 62443 standard series serves as technical guidance.

STRIDE is a structured threat-modelling method (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). For the risk assessment of an installation under the Machinery Regulation and CRA, a STRIDE analysis systematically identifies attack points at the interfaces and derives protective measures. We produce STRIDE risk assessments for installations as the basis for auditable security documentation.

Werkspilot captures all supplier advisories — from CSAF to email — centrally, automatically identifies the affected installations and lets you forward an assessed report to your customers on time. This way you fulfil the CRA reporting chain across hundreds of components and installations without manually checking every feed.