ICS & OT Security
Industrial security: companies launch CRA and NIS2 readiness projects
Key takeaways
- Industrial firms increasingly merge CRA product duties and NIS2 organisational duties in joint readiness programmes — separate spreadsheets fail on supply chains and OT reality.
- A credible gap assessment prioritises products with digital elements, critical OT assets and conformity/reporting gaps across the value chain.
- SBOM, secure-by-design and IEC 62443 offer different but complementary structure — not interchangeable, but meshable in one architecture board.
- Manufacturers and integrators should plan notified bodies and September 2026 reporting early; pure operators focus on NIS2 registers and supplier control.
- Readiness is not compliance theatre: without delivery-ready roles, programmes stall on slides.
Industrial security faces a dual load in 2026: the Cyber Resilience Act shifts product and supplier accountability; NIS2 demands organisational resilience and reporting. Industrial firms — from machinery and energy to critical suppliers — are therefore launching CRA and NIS2 readiness projects that merge both worlds in one steering model.
This article explains how to build a credible readiness programme: gap assessment, SBOM, secure-by-design, IEC 62443, OT security and concrete preparation for upcoming CRA milestones. Not legal advice.
Why industry prioritises differently
In OT environments, availability, functional safety and cybersecurity collide. Patches need maintenance windows, legacy assets run for decades, remote maintenance is economically essential — and an attack path. Treating CRA as “IT only” misses that controllers, gateways and engineering workstations are or contain products with digital elements.
NIS2 also hits many operators in energy, transport, manufacturing and digital infrastructure. The seam is obvious: a compromised update module is a CRA product issue and an NIS2 incident. Our OT security market landscape shows why delivery-ready teams matter here.
Readiness programme: four phases
Phase 1 — Scope and applicability
First clarify: manufacturer, importer, operator or mix? CRA duties depend on role in the value chain; NIS2 on sector and size — see NIS2 in Germany.
In parallel: portfolio of all products with digital elements — hardware, embedded software, remote maintenance portals, edge gateways. Classify OT assets by criticality and connectivity.
Phase 2 — Gap assessment
A solid gap assessment compares current state with CRA Annex I requirements, planned harmonised standards, IEC 62443 target zones and NIS2 measure catalogues. Typical gaps:
- missing SBOM maintenance in development,
- unclear support end dates for field devices,
- split incident processes for IT, OT and product security,
- contracts without update and vulnerability clauses for OEMs.
Gap assessment — priority matrix
- High / short term: reporting from September 2026, critical product classes, internet-exposed OT.
- High / medium term: conformity modules for important products, notified bodies.
- Medium: IEC 62443 zone refinement, supplier register.
- Structural: shared governance boards for CRA, NIS2 and safety.
Phase 3 — Implementation packages
Readiness should ship in packages engineering can deliver:
- Secure-by-design / secure-by-default in product lines and retrofit policies,
- SBOM toolchain in CI/CD and supplier onboarding,
- Vulnerability inbox with 24h/72h escalation toward the ENISA platform,
- OT segmentation and maintenance access per IEC 62443 — see IEC 62443 and hiring.
Phase 4 — Evidence and audit readiness
Technical files, declarations of conformity, risk registers and logs of security-relevant changes must exist versioned — not assembled before customer audits. Align with CRA implementation guidelines.
SBOM in industrial supply chains
Germany’s BSI describes the software bill of materials as a software ingredient list — machine-readable, used in vulnerability handling, without publication duty. In industrial projects the SBOM is often the first hard supply-chain test:
- Do you contractually receive SBOMs from OEM components?
- Do third-country firmware stacks feed your product SBOM?
- Who maintains updates when the component vendor ends support?
Without SBOM discipline, CRA reporting becomes blind flying.
IEC 62443 and CRA: complementary, not duplicate
IEC 62443 structures roles, zones and conduit models in industrial automation. CRA defines market-access duties for products with digital elements. A sensible readiness model maps requirements:
| Topic | IEC 62443 | CRA |
|---|---|---|
| Architecture | Zones / conduits | Secure by design |
| Components | SL targets | SBOM, conformity |
| Operations | Patch under change control | Support, updates |
| Incidents | Process integration | ENISA reporting platform |
Conflicts arise when safety approvals and security patches stay uncoordinated — a governance topic for board and plant leadership; see cybersecurity board governance.
OT security: operational gaps
Typical OT gaps in readiness projects:
- Asset transparency: incomplete inventories of PLCs, HMIs, gateways,
- Remote maintenance: ad-hoc VPNs instead of controlled jump servers,
- Identities: shared engineering accounts,
- Monitoring: IT SOC without OT protocol understanding.
Prioritise measures with direct operational impact — not paperwork alone.
Mini checklist: CRA preparation for industry
Document product RACI per sales channel (manufacturer/importer/distributor).
Test reporting playbook with ENISA platform interface by Q3 2026.
Review top-10 OEM contracts for update, SBOM and incident clauses.
Identify notified body if important/critical product classes apply — relevant from June 2026.
Parallel NIS2 preparation
Readiness without NIS2 is half a job. For in-scope operators:
- BSI registration and risk management — registration deadline,
- unified incident fact base for SOC, OT and product security,
- management training and evidence logic.
CRA and NIS2 reports can overlap — one ticket model saves time and liability risk.
People and programmes
Readiness projects rarely fail on missing slides but on missing hybrid profiles: OT security, product security, compliance engineering. Talent is tight — see critical infrastructure talent market. Early hiring beats rescue headhunting before certification windows.
Conclusion
CRA and NIS2 readiness projects in industry need one steering model: gap assessment across product and OT, SBOM and secure-by-design in development, IEC 62443 in operations architecture, reporting and conformity paths from 2026. Planning both regimes separately doubles cost — meshing them buys operational resilience and audit-ready supply chains.
Further reading: EU CRA for companies, Cyber resilience foundations. Hiring: Cybersecurity recruitment.
Source
German Federal Office for Information Security (BSI) — Cyber Resilience Act
FAQ
- Two workstreams at the product vs organisation seam — but one shared data backbone for suppliers, vulnerabilities and incidents. Otherwise plant and group IT pursue conflicting priorities.
- IEC 62443 structures industrial cybersecurity well but does not replace CRA conformity or NIS2 reporting logic. Synergies exist on roles, segmentation and supplier requirements — a formal mapping table is mandatory.
- OT security architects, product security with firmware depth and regulatory engineers linking CRA modules and IEC zones. Perfomynd supports with outcome-based search profiles.