Werkspilot

    Service for machine and plant builders

    Cybersecurity risk assessment under the Machinery Regulation and the CRA – per system type, ready to sign in two weeks.

    From 20 January 2027 the Machinery Regulation (EU) 2023/1230 applies. With it, protection against corruption becomes one of the essential requirements that have to be met before CE marking (Annex III, 1.1.9 and 1.2.1). This covers the connection to other devices, including via USB and remote access, as well as safety-relevant software and data. From 11 December 2027 the CRA additionally requires a documented cybersecurity risk assessment for the product itself (Art. 13(2) and (3)).

    Both come out of one threat analysis per system type. The Machinery Regulation takes the scenarios that hit a safety function, the CRA the mapping to Annex I including residual risks. We produce this base assessment in two sessions with your design team; after two weeks it is ready to sign. After that, each order only documents what differs from the system type.

    Request an intro call

    The assessment ends at the interface to the customer network

    The first decision comes before the first threat: where does the installation end? The most workable boundary so far is this one: the customer network stays outside, the interface to it is inside. The assessment therefore covers:

    • the plant network with fieldbus (PROFINET, EtherCAT), controllers and drives
    • the operator level: HMI and local control panels
    • USB ports and removable media
    • remote maintenance router and VPN access
    • the firewall to the customer network and the MES/ERP connection, usually via OPC UA
    • physical access to the control cabinet
    • the commissioning laptop, which sits in several networks during commissioning

    Not part of the assessment are the operator's IT network and the firmware of purchased components. What is inside a purchased PLC is assessed by its manufacturer; the plant builder may rely on that manufacturer's advisories.

    Two sessions, with the threat analysis in between

    1. 1

      System capture

      Together with engineering or project management we capture the system type: network diagram, components, interfaces, remote maintenance path and the assumptions about the operating environment.

    2. 2

      Threat analysis

      We ask the six STRIDE questions per interface, rate the risks, define measures and map every row to CRA Annex I, and additionally to Machinery Regulation Annex III where a safety function is affected.

    3. 3

      Walkthrough with the design team

      In the second session we go through the results with the design team. They sign the assessment, and the session is there so that they know what they are signing.

    After two weeks the assessment is ready to sign.

    The finished assessment consists of six parts

    1. System description with network diagram, zones and data flows, operating environment and assumptions
    2. Threat analysis per interface using STRIDE
    3. Risk rating with measures, referenced to IEC 62443-3-3 and -4-2
    4. Mapping to CRA Annex I for the technical documentation and to Machinery Regulation Annex III for the risk assessment under EN ISO 12100
    5. Residual risks with justification and the assumptions that belong in the instructions for use
    6. Maintenance rule: when the assessment is revisited and how the per-order delta is documented

    Special-purpose machines also need one assessment per system type, not per order

    The most common objection is: “Every one of our installations is unique.” For the cyber threat picture that is rarely true. The attack surface is defined by the control platform, the operator level, the remote maintenance path and the connection to the customer network, and these repeat across the portfolio. That is why we scope the assessment by control platform and interfaces, not by order.

    The Commission reads the CRA the same way: for variants with the same architecture and the same risks, one shared risk assessment is sufficient; different interfaces or a different remote access have to be reflected in it (Guidelines C(2026) 5252, paras 174 to 176, not legally binding). That is exactly the per-order delta: additional interfaces, the specific MES connection, different components.

    We review an existing template as a gap analysis

    If you already have your own template or first assessments, you do not start from scratch. We check the document against Machinery Regulation Annex III 1.1.9 and 1.2.1, CRA Art. 13 and Annex I, and the content list for threat models in IEC 62443-4-1 (SR-2), and state for each gap what has to be added.

    Afterwards the assessment becomes the template for the following projects

    The risk assessment is the one-off part of CRA work. In Werkspilot it serves as the template for further projects of the same type. What stays ongoing is vulnerability management across the delivered installations. The method and a worked STRIDE example on a packaging machine are in the article on risk assessment.

    Frequently asked questions on cybersecurity risk assessment

    No. It covers malfunction, wear and misuse, not deliberate interference. The existing document remains valid and is supplemented by the threat analysis; it is not replaced.

    No. One base assessment is produced per system type, and a documented delta per order. The Commission's CRA guidelines allow one shared risk assessment for variants with the same architecture and the same risks (C(2026) 5252, paras 174 to 176). The scope follows the control platform and the interfaces.

    None. The CRA and the Machinery Regulation are method-neutral; the Commission's CRA FAQ (v1.4, no. 4.1.2) requires threat modelling that fits the intended purpose of the product. We work with STRIDE per interface, a grid of likelihood and severity, and IEC 62443 as the reference for measures.

    For the Machinery Regulation, for machinery placed on the market from 20 January 2027. For the CRA, for products placed on the market from 11 December 2027. Anyone delivering in this period introduces the assessment into the running order book.

    A network diagram, the component list (for example from EPLAN), a list of interfaces including the remote maintenance path, and one person from engineering or design who knows the system type. Whatever is missing we capture together in the first session.

    No. The risk assessment is part of the technical documentation. The conformity assessment and the EU declaration of conformity stay with the manufacturer, that is the plant builder who places the installation on the market. We produce the assessment, the design team signs it.

    Request an intro call on the risk assessment.

    30 minutes on system type, interfaces and schedule. We reply by email with proposed dates.