EU Cyber Resilience Act (CRA) and IEC 62443 Security
FCU2601 IEC 62443 Certification
Forlinx FCU2601 Achieves Dual IEC 62443 Certifications
Recently, the Forlinx FCU2601 Embedded Control Unit successfully passed both the IEC 62443-4-1 Secure Product Development Lifecycle certification and the IEC 62443-4-2 Component Security certification. Following our EN 18031 (RED) cybersecurity certification earlier this year, this marks another breakthrough for Forlinx in industrial cybersecurity, providing evidence of Forlinx's secure development processes and product security practices.
IEC 62443 for Industrial Cybersecurity
Jointly developed by ISA and IEC, the IEC 62443 series is the internationally recognized, authoritative standard for Industrial Automation and Control Systems (IACS) cybersecurity. It covers the entire lifecycle of product development, system integration, and operations management. The two certifications address different aspects of product security: IEC 62443-4-1 focuses on secure product development processes, while IEC 62443-4-2 addresses technical security requirements for components.
Understanding the EU Cyber Resilience Act
Failure to meet applicable requirements can result in penalties and corrective measures.
The EU Cyber Resilience Act (CRA) entered into force on 10 December 2024. Its reporting obligations apply from 11 September 2026, while its main obligations apply from 11 December 2027.
Potential Penalties and Enforcement
- Certain infringements may result in fines of up to €15 million.
- Some infringements may carry a maximum fine of up to 2.5% of total worldwide annual turnover.
- The applicable maximum depends on the infringement and the relevant legal provisions.
- Market surveillance authorities may require corrective action or restrict market access where applicable.
Product Scope & Conformity Assessment
- CRA applicability depends on the product's intended use and scope.
- Important and critical product categories may be subject to specific assessment requirements.
- Third-party conformity assessment is required where the applicable CRA procedure specifies it.
- Review the relevant product category and conformity assessment route before making compliance claims.
Key CRA Dates & Reporting
- 11 June 2026: Provisions on notifying conformity assessment bodies apply.
- 11 September 2026: Reporting obligations for actively exploited vulnerabilities and severe security incidents apply.
- 11 December 2027: The CRA's main requirements apply.
- Reporting deadlines depend on the type of event and the applicable CRA provisions.
CRA Implementation Timeline
Seize the initiative by staying ahead of key regulatory milestones.
Act Enters into Force
The CRA entered into force. Its main obligations apply later, subject to the Regulation's transition rules.
Conformity Assessment Bodies
Provisions concerning the notification of conformity assessment bodies begin to apply.
Vulnerability & Incident Reporting
Reporting obligations apply to actively exploited vulnerabilities and severe incidents within the CRA's scope.
Main CRA Requirements Apply
The CRA's main obligations apply to products with digital elements within its scope, subject to applicable transitional provisions.
Product Security Support for CRA Planning
Forlinx's IEC 62443 experience can inform product security planning. Available services, scope, and deliverables should be confirmed for each project.
Secure Development Lifecycle Review
- Discuss secure development practices informed by IEC 62443-4-1
- Review development processes and available evidence
- Identify potential process and documentation gaps
- Scope and deliverables confirmed for each project
Security Design & Assessment
- Threat modeling and secure architecture review, where agreed
- Security testing scope defined for each project
- IEC 62443-4-2 used as a reference where applicable
- Coverage depends on the product and agreed engagement
SBOM Generation & Management
- Support the generation and maintenance of software component inventories.
- Track software dependencies and relevant vulnerabilities.
- Support vulnerability assessment and remediation workflows.
- Align SBOM practices with applicable product security requirements.
Vulnerability Handling & Security Updates
- Establish processes for vulnerability intake and triage.
- Support remediation, patch distribution, and security updates.
- Define responsibilities for vulnerability handling throughout the product support period.
- Review applicable CRA reporting deadlines and notification procedures.
Pre-Assessment & Compliance Guidance
- Discuss applicable assessment routes
- Identify potential documentation and evidence gaps
- Plan relevant testing activities
- Specific services and deliverables confirmed per project
Embedded Product Support
- SoMs, SBCs, and industrial computers
- Gateways, HMIs, and other embedded systems
- Support options depend on product and project scope
- Contact Forlinx to discuss your technical requirements
Official CRA Resources
Consult the European Commission's official resources for the Regulation, implementation guidance, and reporting obligations.
CRA Overview
Read the European Commission's overview of the Cyber Resilience Act and its implementation.
Legal Summary
Review the main provisions, product scope, conformity assessment routes, and transitional rules.
Reporting Obligations
Check the reporting process and deadlines for actively exploited vulnerabilities and severe security incidents.
Embedded Platforms with Security Features Relevant to CRA Planning
Explore embedded platforms with security features that may support your product security strategy. Security capabilities and certification status vary by product and application.
FCU2601 Embedded Control Unit
Dual IEC 62443 CertifiedSecure Product Development Lifecycle
Component Security
FET3568-C SoM
Rockchip RK3568TrustZone Support
Hardware Cryptographic Engine
FET-MX9596-C SoM
NXP i.MX 95NXP Security Architecture
Supports Functional-Safety Development
FET6254-C SoM
TI AM62xTI Secure Boot
Hardware Security Module
Security features and certifications vary by product. CRA conformity must be assessed for the final product configuration, intended use, and applicable legal requirements. Processor-level security features do not by themselves establish conformity of a complete product.
Plan Your CRA Compliance Strategy with Forlinx
Work with Forlinx Embedded to review product security requirements, evaluate relevant embedded platforms, and plan technical activities that support your CRA compliance process.
Discuss Your CRA RequirementsHotline: +86-312-3102650 EXT 799 | Technical Support: [email protected]