Insights
CRA, the Machinery Regulation and vulnerability management for machine and plant builders and integrators.
SBOM by manufacturer: what Siemens, Beckhoff, Rockwell and ten others actually provide
13 controller and component manufacturers compared, measured on 7 Oct 2026: advisory volume, CSAF feed, product identifier, SBOM access and which protocol delivers the device list for each.
Beckhoff SBOM: getting EtherCAT terminals and the IPC into the device list
What hangs on a Beckhoff IPC, what a network scan sees of it and how the EtherCAT terminals get into the device list with type, revision and firmware: TwinCAT project, ADS route, Device Manager. Plus the 17 CSAF advisories via CERT@VDE.
B&R SBOM: getting X20 modules and POWERLINK devices into the device list
What hangs on a B&R controller, what a network scan sees of it and how X20 modules and POWERLINK devices get into the device list with order number and firmware: Automation Studio, System Diagnostics Manager, OPC UA. Plus the advisories in the ABB CSAF feed.
Rockwell SBOM: getting the Logix rack, modules and EtherNet/IP devices into the device list
What hangs on a Logix controller, what a ListIdentity scan sees of it and how rack modules, POINT I/O and drives get into the device list with catalog number and firmware revision: CIP routing, Studio 5000, SNMP. Plus 337 advisories with catalog numbers.
Schneider Electric SBOM: getting the Modicon rack, X80 modules and drives into the device list
What hangs on a Modicon controller, what a network scan sees of it and how X80 modules, TM3 expansions and Altivar drives get into the device list with reference and firmware: Modbus FC43, Identity Object, Control Expert. Plus 291 CSAF documents without CPE.
WAGO SBOM: getting controllers, couplers and K-bus modules into the device list
What hangs on a WAGO controller, what a network scan sees of it and how the I/O modules on the terminal bus get into the device list with order number: WAGO-I/O-CHECK, CODESYS project, Web-Based Management, SNMP, I&M0. Plus 82 CSAF advisories with placeholder order numbers.
Phoenix Contact SBOM: getting PLCnext, Axioline modules and IO-Link into the device list
What hangs on a PLCnext controller, what a network scan sees of it and how Axioline modules and IO-Link devices get into the device list with article number and firmware: PROFINET I&M0 per slot, PLCnext Engineer, IO-Link master. Plus 113 CSAF advisories via CERT@VDE.
Bosch Rexroth SBOM: getting ctrlX CORE, drives and couplers into the device list
What hangs on a ctrlX controller, what a network scan sees of it and how EtherCAT drives and S20 couplers get into the device list with material number and version: ctrlX Data Layer, IndraWorks, I&M0, OPC UA. Plus 42 advisories as HTML without CSAF.
Omron SBOM: getting NJ/NX, EtherCAT units and servos into the device list
What hangs on an Omron NJ/NX controller, what a network scan sees of it and how NX I/O, 1S servos and safety units get into the device list with model and unit version: Sysmac Studio, EtherNet/IP Identity Object, SNMP. Plus 25 advisories as PDF.
Mitsubishi Electric SBOM: getting MELSEC CPU, modules and CC-Link stations into the device list
What hangs on a MELSEC controller, what a network scan sees of it and how rack modules and CC-Link IE stations get into the device list with module type and firmware: GX Works3, SLMP, EtherNet/IP ListIdentity. Plus the advisories via CISA.
Pilz SBOM: getting the safety controller, expansion modules and PIT devices into the device list
What hangs on a Pilz safety controller, what a network scan sees of it and how base, expansion and communication modules get into the device list with order number and firmware: PNOZmulti Configurator, PAS4000, PROFINET I&M0. Plus 20 CSAF advisories via CERT@VDE.
Festo SBOM: getting the CPX controller, AP modules and IO-Link into the device list
What hangs on a Festo CPX controller, what a network scan sees of it and how CPX-AP modules, valve terminals and IO-Link devices get into the device list with part number and firmware: I&M0 per slot, AP master, Automation Suite. Plus 18 CSAF advisories via CERT@VDE.
SICK SBOM: getting scanners, Flexi Soft and IO-Link sensors into the device list
What hangs on a SICK safety controller, what a network scan sees of it and how Flexi Soft modules, safety scanners and IO-Link sensors get into the device list with part number and firmware: I&M0, Safety Designer, SIG master. Plus 71 advisories in SICK's own CSAF feed.
PROFINET SBOM: what I&M0 reveals about every device and why DCP is not enough
What the I&M0 record reveals about every PROFINET device, why DCP only names the type and how the plant SBOM is built from it. With field list, query path and gaps.
EtherNet/IP SBOM: how one ListIdentity broadcast identifies every device in the subnet
How the CIP Identity Object identifies EtherNet/IP devices, why a UDP broadcast on port 44818 captures the whole subnet and what is still missing in chassis and catalogue numbers.
EtherCAT SBOM: how terminals without an IP address get into the device list
Why EtherCAT participants are invisible to a network scan, which identity is stored in the SII EEPROM and CoE object 0x1018 and how the terminal list gets into the plant SBOM via TwinCAT, ADS or CODESYS.
Modbus TCP SBOM: what function code 43 provides and where it is missing
What "Read Device Identification" (FC 43/14) reveals about a Modbus device, why the service is optional, knows no serial number and has to do without discovery – and how Modbus devices still get into the plant SBOM.
OPC UA SBOM: what BuildInfo and the nameplate reveal about the controller
What ServerStatus/BuildInfo and the DeviceType nameplate of the OPC UA companion specifications reveal about controllers, how discovery works on port 4840 and why OPC UA does not replace the field devices.
SNMP SBOM: how switches, routers and PROFINET devices are identified
What the SNMP system group and the ENTITY-MIB reveal about network devices and PROFINET participants, why sysDescr has to be parsed per manufacturer and how SNMP closes the gaps of PROFINET and EtherNet/IP.
IO-Link SBOM: what the master provides about every sensor and what it does not
Which identification parameters the IO-Link specification V1.1.3 prescribes, which are optional, and through which paths (PROFINET submodule, OPC UA, JSON/REST) the master hands out the sensor list for the plant SBOM.
Scanning a plant for the SBOM: PROFINET, SNMP and IP scans together yield the device list with order number and firmware
No single tool delivers order number and firmware for every device in a plant. Which scan methods complement each other, depending on the control system world.
When a vulnerability counts as known under the CRA: the Commission names the EUVD as the yardstick
Annex I of the Cyber Resilience Act requires products without known exploitable vulnerabilities but does not say when a vulnerability is known. The Commission guidelines answer with the EUVD and other public databases. What that means for plant builders at the moment of placing on the market.
Suppliers without CSAF: how plant builders monitor their vulnerabilities anyway
The BSI's public CSAF list holds 15 entries, eight of them industrial. Why the CRA prescribes no format for security advisories, why the draft harmonised standard treats CSAF only as an enhancement – and how to reliably monitor suppliers that publish by PDF, mail or RSS.
Cybersecurity risk assessment for machinery: what the Machinery Regulation and the CRA need from it, with a STRIDE example
The CRA and the EU Machinery Regulation both require a documented cybersecurity risk assessment. Both come out of one STRIDE threat analysis per system type: the Machinery Regulation takes the safety-relevant part, the CRA the mapping to Annex I including residual risks. What each regulation needs in concrete terms, where IEC 62443 and prEN 50742 fit in, worked through on a packaging machine with remote access.
SBOM tools for plant builders: capturing the bill of materials, the engineering project and the network scan
The common SBOM tools need a build – in plant engineering there is none. Which tools cover the three realistic routes: exports from ERP and EPLAN, the hardware export from the engineering system, scanning tools from PRONETA to OTbase – with a comparison of when which scanning tool is the right one.
Placing on the market in plant engineering: which date decides CRA applicability
A plant ships in partial deliveries across two years – so when is it placed on the market? What the CRA actually says, why the final delivery milestone gets used as the cut-off, and where that practice does not hold.
Cybersecurity roadmap for machine and plant builders: what has to be ready by when
The CRA and Machinery Regulation deadlines are well known – the roadmap behind them is not. What actually has to be finished by 11 Sep 2026, 20 Jan 2027 and 11 Dec 2027, in the order in which each step depends on the previous one.
Creating an SBOM in special machinery and plant engineering: where the data comes from when there is no source code
Every guide to creating an SBOM assumes your own build – a plant builder does not have one. The workable sources are the bill-of-materials export, the engineering project and a network scan at acceptance testing. What each source provides, what none can do alone, which depth the SBOM needs – and when in the project this has to happen.
CRA reporting obligation since September 2026: What must be reported for machines and plants?
Since 11 Sept 2026 the CRA reporting obligation applies: what manufacturers must report (and what not), the 24 h / 72 h / 14-day deadlines and ENISA's SRP.
CRA tool selection for plant builders: four questions and one test for the demo
Most vulnerability tools are built for software vendors. In plant engineering the risk sits in third-party firmware from dozens of suppliers. Four selection questions as a checklist, a demo test, and why CPE matching does not carry.
When a plant builder or integrator becomes a CRA manufacturer
Cyber Resilience Act: when a plant builder or integrator becomes the manufacturer through system integration – placing on the market, substantial modification (Art. 22) and the layered model of supplier obligations.
CRA and the Machinery Regulation for integrators and plant builders: what applies from 2026
Does the CRA make a plant builder a manufacturer? How the CRA and Machinery Regulation interact, the three deadlines and where they differ.