Question 1

Who does the Cyber Resilience Act apply to for machine and plant builders and integrators?

Accepted Answer

The CRA applies to products with digital elements placed on the EU market — in machine and plant engineering, that means controllers, networked components and the installation as a whole system with a software share. Any integrator or plant builder who integrates third-party components and places them on the market under their own name is considered a manufacturer under the CRA and carries its obligations.

Question 2

When do the CRA reporting obligations apply to machine and plant builders and integrators?

Accepted Answer

The reporting obligations of the Cyber Resilience Act (CRA) apply from 11 September 2026. From that date, manufacturers — including machine and plant builders and integrators — must report actively exploited vulnerabilities and severe security incidents to the competent national authority (CSIRT) and to ENISA. The remaining CRA requirements apply in full from 11 December 2027.

Question 3

What has to be reported within 24 hours?

Accepted Answer

The fixed deadlines apply towards the authorities: via ENISA's single reporting platform, an actively exploited vulnerability or a severe security incident requires an early warning to the coordinating CSIRT and ENISA within 24 hours of becoming aware, a more detailed notification within 72 hours, and a final report later on. Affected users, by contrast, are informed not on an hourly deadline but "without undue delay" about the vulnerability or incident and any countermeasures. For integrators and plant builders with hundreds of components per installation, neither is realistic without automated vulnerability management.

Question 4

What is an SBOM — and why does a plant builder need one?

Accepted Answer

An SBOM (Software Bill of Materials) is a complete inventory of all software components of a product. The CRA requires manufacturers to know and document their components. For plant builders, the SBOM is the basis for instantly identifying which installations are affected when a vulnerability is reported.

Question 5

How does supplier vulnerability monitoring work?

Accepted Answer

Werkspilot continuously monitors your suppliers' security advisories — structured CSAF feeds as well as mailing lists, RSS or unstructured emails. Every new vulnerability (CVE) is automatically matched against your installations in the field, so you immediately see which installations are affected. This continuous monitoring produces one central, normalized overview instead of scattered individual alerts.

Question 6

How does CVE monitoring across the supply chain work?

Accepted Answer

CVE monitoring across the supply chain means: new vulnerabilities (CVEs) from your suppliers' security advisories are captured continuously and automatically matched against the components in your installations in the field. Werkspilot normalizes structured CSAF feeds as well as mailing lists, RSS and unstructured emails — because many suppliers don't publish their CVEs as CSAF. So for every new CVE you immediately see which installations are affected, instead of searching manufacturer advisories by hand.

Question 7

What is CSAF — and what role does it play in monitoring?

Accepted Answer

CSAF (Common Security Advisory Framework) is a machine-readable standard format for security advisories, increasingly used by manufacturers and authorities such as the German BSI and the US CISA. Machine-readable CSAF feeds can be processed automatically — the basis for monitoring supplier vulnerabilities without manual research and immediately mapping them to affected installations.

Question 8

How long do security updates have to be provided under the CRA?

Accepted Answer

Manufacturers must handle vulnerabilities and provide security updates throughout the support period — at least five years, unless the product's expected lifetime is shorter. For long-lived industrial installations this period can be correspondingly longer.

Question 9

What penalties apply for CRA violations?

Accepted Answer

For violations of the essential cybersecurity requirements, the CRA provides for fines of up to €15 million or 2.5% of worldwide annual turnover — whichever is higher. That alone is reason for integrators and plant builders to establish vulnerability and reporting processes early.

Question 10

How are the Cyber Resilience Act and the Machinery Regulation connected?

Accepted Answer

The EU Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and contains its own cybersecurity requirements. The CRA and the Machinery Regulation interlock: meeting the CRA requirements for vulnerability handling, SBOM and security by design covers essential cybersecurity duties of the Machinery Regulation. The IEC 62443 standard series serves as technical guidance.

Question 11

What is a STRIDE threat analysis and when do I need one?

Accepted Answer

STRIDE is a structured threat-modelling method (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). For the risk assessment of an installation under the Machinery Regulation and CRA, a STRIDE analysis systematically identifies attack points at the interfaces and derives protective measures. We produce STRIDE risk assessments for installations as the basis for auditable security documentation.

Question 12

How does Werkspilot help with vulnerability management across the supply chain?

Accepted Answer

Werkspilot captures all supplier advisories — from CSAF to email — centrally, automatically identifies the affected installations and lets you forward an assessed report to your customers on time. This way you fulfil the CRA reporting chain across hundreds of components and installations without manually checking every feed.

CRA vulnerability management for machine and plant builders — from your own firmware to supplier components.

Under the CRA, actively exploited supplier vulnerabilities must be passed on within 24 hours.

Werkspilot covers the entire CRA process in a single platform.

Create SBOMs

Monitor supplier feeds

Monitor your own software

Assess exposure

Manage documentation

Report on time

STRIDE threat analysis of your installations for CRA and the Machinery Regulation.

Articles on the CRA and the Machinery Regulation.

Cybersecurity roadmap for machine and plant builders: what has to be ready by when

CRA reporting obligation from September 2026: What must be reported for machines and plants?

Frequently asked questions on the CRA, the Machinery Regulation and vulnerability management for machine and plant builders and integrators.

Request a demo now.