Using IEC 62443 to Meet Cyber Resilience Act Requirements

The European Union's Cyber Resilience Act (CRA) sets new cybersecurity requirements for manufacturers of products with digital elements. The international standard series IEC 62443 gives you a sound framework to implement these requirements systematically. The process standard IEC 62443-4-1 in particular covers many of the CRA's requirements.

Contents

1. Process and technical requirements in the CRA
2. Process requirements: largely covered by IEC 62443-4-1
3. Software bill of materials (SBOM) in IEC 62443-4-1
4. Technical requirements: gaps in IEC 62443-3-3 and IEC 62443-4-2
5. Supplementary standards to close the gaps
6. Complementary use despite different scopes
7. Conclusion: process and technology together

Process and technical requirements in the CRA

The CRA sets requirements both for the processes of product development and for the technical properties of the products themselves. Because of this dual approach, you need to look at the available standards separately for each side.

Process requirements: largely covered by IEC 62443-4-1

IEC 62443-4-1, “Secure product development lifecycle requirements”, covers most of the CRA's process requirements. It provides a full framework for developing secure products and addresses topics such as:

• security management
• requirements analysis
• secure design and implementation
• verification and validation
• handling of vulnerabilities and updates
• user documentation

If you apply IEC 62443-4-1 consistently, you can meet the CRA's process requirements and build them into your development processes.

Software bill of materials (SBOM) in IEC 62443-4-1

IEC 62443-4-1 contains no explicit requirement to create a software bill of materials (SBOM) as the CRA requires. In practice, however, a correct and complete implementation of the standard often produces an SBOM or similar documentation along the way:

• Requirements management: The standard requires detailed documentation of all components and their security requirements.
• Configuration management: It requires accurate tracking of all software components and their versions.
• Supplier management: The standard requires careful monitoring and documentation of third-party components.
• Patch management: Effective patch management requires precise knowledge of all software components.

Together, these processes produce thorough documentation of the software components, which you can easily turn into a formal SBOM. If you implement IEC 62443-4-1 thoroughly, you will find that you already collect and maintain most of the information an SBOM needs.

Technical requirements: gaps in IEC 62443-3-3 and IEC 62443-4-2

IEC 62443-3-3, “System security requirements and security levels”, and IEC 62443-4-2, “Technical security requirements for IACS components”, do not fully cover the technical properties the CRA requires of products. These standards were designed mainly for industrial applications and have some gaps:

• No data protection requirements. IEC 62443-3-3 and IEC 62443-4-2 contain no specific data protection requirements, although data protection plays an important role in the CRA.
• Limited scope. The focus on industrial systems does not cover all product categories the CRA addresses.
• Not enough detail in some areas. Some specific technical properties the CRA requires are not covered, or not in enough detail.

Supplementary standards to close the gaps

To close the gaps in the technical requirements, you can draw on supplementary standards:

• ETSI EN 303 645
  This standard defines cybersecurity requirements for consumer IoT devices. It addresses many of the technical properties the CRA requires, especially data protection and security for consumer products.
• EN 18031
  This standard sets cybersecurity requirements for radio equipment and implements the delegated act under the Radio Equipment Directive. It provides useful requirements for the security of products with radio interfaces, which also fall under the CRA.

ENISA published a detailed mapping of the CRA requirements to various standards some time ago. Our article on mapping the CRA to standards gives more details.

The following examples show the differences and gaps in the technical requirements:

CRA	IEC 62443	ETSI EN 303 645
Products should process only data that is necessary for their function.	Contains no specific requirements on data minimization.	Recommends keeping the processing of personal data in telemetry to the minimum necessary for the intended functionality (provision 6-4).
Protection from unauthorized access through appropriate control mechanisms.	The requirements under FR 1 (Identification and authentication control) set out detailed requirements for various aspects of access control, including identification and authentication.	Contains requirements on authentication, for example passwords that are unique per device or defined by the user once the device is no longer in its factory default state. These are much less detailed than those of IEC 62443-4-2.
Products must be delivered with a secure default configuration.	IEC 62443-4-2 requires in CR 7.7 “Least functionality” that components can be configured so that only necessary functions are enabled.	Requires that, in any state other than the factory default, all device passwords are either unique per device or defined by the user.

EN 18031 becomes relevant where neither IEC 62443-4-2 and IEC 62443-3-3 nor ETSI EN 303 645 provide requirements. One example is minimizing the negative impact on other devices or networks, which EN 18031 addresses.

Complementary use despite different scopes

The standards have different scopes, but together they give you a solid basis for implementing the CRA requirements:

• IEC 62443: focus on industrial applications
• ETSI EN 303 645: aimed at consumer IoT devices
• EN 18031: applies to radio equipment in consumer and industrial settings

Despite these different focuses, you can use the standards side by side to cover the wide range of CRA requirements. The combination lets you address both industrial and consumer aspects and include specific requirements for radio equipment.

Conclusion: process and technology together

Implementing the CRA requires an approach that covers both process and technical aspects. No single standard covers all CRA requirements, but a combination of standards gives you a solid basis.

IEC 62443-4-1 is an excellent basis for the CRA's process requirements. Companies that already work to this standard have a clear head start. The standard does not explicitly require an SBOM, but a thorough implementation of IEC 62443-4-1 often means you already collect the information you need for one.

For the technical requirements, a combination of IEC 62443-4-2 and IEC 62443-3-3, ETSI EN 303 645, and EN 18031 gives the widest coverage:

• IEC 62443-4-2 and IEC 62443-3-3 provide detailed technical requirements, especially for industrial systems.
• ETSI EN 303 645 adds specific requirements for consumer IoT devices, especially on data minimization and data protection.
• EN 18031 closes important gaps, especially on requirements for radio equipment and their impact on other devices and networks.

When implementing the CRA, manufacturers should:

1. Implement IEC 62443-4-1 as the basis for their development processes.
2. Use the technical requirements of IEC 62443-4-2 and IEC 62443-3-3 as the baseline for their products.
3. Draw on ETSI EN 303 645 and EN 18031 for additional requirements that IEC 62443 does not cover.
4. Identify the gaps that none of the standards fully covers and develop their own solutions.

This integrated approach helps you develop resilient, compliant products that meet both the regulatory requirements and the security needs of different application areas. Standards will continue to evolve, so be ready to adjust your approach when new or updated standards are published.

In the end, successful CRA implementation depends on combining these standards and good practices into a coherent, product-specific security concept. This takes technical know-how as well as a sound understanding of the regulatory requirements and of the specific risks in each application area.

If you need support in applying these standards or implementing the CRA requirements, contact us for a no-obligation conversation. Our experts have extensive experience in implementing standards and regulatory requirements and can help you develop a strategy tailored to your company.