Secure your machines and systems with expert knowledge

At a time when cyber threats are becoming increasingly complex, compliance with the latest security standards is crucial. Our Product Security Consulting supports mechanical engineering companies and plant operators in implementing the cyber security standards required by NIS2 and CRA - directly in their machines and plants.

Our services include:

• Analysis and evaluation: We analyze your current security measures and evaluate their compliance with the current NIS2 and CRA requirements.
• Implementation: We help you to implement the Product Security Standards as an elementary part of your product development strategy, purchasing strategy or plant audits.
• Training : Our team provides training to ensure that your staff fully understand and can correctly apply the new safety measures.

NIS2 Directive

• Purpose: The NIS2 Directive aims to ensure a high common level of cybersecurity in the EU, especially for companies providing critical infrastructure or essential services.
• Area: It significantly extends the scope compared to the previous NIS Directive by covering more sectors and facilities. These include:
  • Essential Entities: Companies in 11 sectors that are classified as critical (e.g. energy, transportation, healthcare).
  • Important Entities: Companies in 7 other sectors (e.g. digital providers, utilities).
• Requirements:
  • Risk management: Companies must implement proactive security measures, including risk assessment and management.
  • Reporting obligations: Cybersecurity incidents must be reported immediately.
  • Cooperation: Increased cooperation and exchange of information between member states and companies.
• Penalties: Non-compliance can lead to substantial fines, up to 10 million euros or 2% of annual worldwide turnover.
• Implementation: The NIS2 Directive came into force and had to be transposed into national law by October 17, 2024.

Cyber Resilience Act (CRA)

• Purpose: The CRA aims to improve the cybersecurity of products with digital elements that are launched on the EU market.
• Scope: The CRA applies to all products with digital elements, including hardware and software, that can establish a network connection.
• Requirements:
  • Security by design: Products must be designed and manufactured securely from the outset.
  • Conformity assessment: Manufacturers must prove the conformity of their products with the CRA requirements.
  • Updates: Security updates must be made available over the entire life cycle of the product.
  • Transparency: Increased transparency about the safety properties of the products.
• Penalties: Non-compliance can lead to penalties of up to 15 million euros or 2.5% of annual turnover.
• Implementation: The CRA is expected to come fully into force in the second half of 2024.