Risk Assessment Roles for Manufacturers, Integrators, and Operators
If you build, integrate, or operate connected machinery, you meet the same demand everywhere right now: assess the risks. The Cyber Resilience Act (CRA) requires it for the cybersecurity of products. The Machinery Regulation requires it for the safety of machinery, and the NIS2 Directive for security in operation.
In practice, it often remains unclear who has to do which part. What must the manufacturer already consider? What can only the operator assess on site? And who handles the risks that arise when a production line is assembled?
A labeling module with remote maintenance access shows the problem. The manufacturer waits for security requirements from the customer. The customer expects the module to be delivered secure. The integrator is supposed to install it in the packaging line and has to clarify whether the protective measures are sufficient for the whole line.
As a result, risks remain untreated, even though everyone assumes that someone else is taking care of them.
The tasks can be assigned clearly. The manufacturer assesses the product, the integrator assesses how it is integrated, and the operator assesses the specific use. The assessments build on each other. None replaces another.
The manufacturer: treat the risks in the product
The manufacturer of the labeling module must assess how its remote maintenance access could be misused and which protective measures are needed. The manufacturer decides on authentication, permissions, and secure updates.
These decisions cannot be left to the later operator. The CRA requires a separate, documented cybersecurity risk assessment. It must feed into development and be updated as needed during the support period.
Why the manufacturer? Because the manufacturer designs the product. The operator can often only compensate for missing protective functions later by adding measures in their own environment.
The manufacturer must consider the intended use and the reasonably foreseeable use. Customer requirements help to make these specific. They are not a precondition for starting the assessment.
Conditions of use: state clearly what is assumed
A product does not have to be designed for every conceivable environment. The manufacturer must, however, describe the conditions under which it can be used securely.
For the labeling module, this could mean:
Operation in a segmented production network. Remote maintenance only through a secured access path. No direct reachability from the internet.
Such assumptions belong in the user information. The blanket sentence “The operator is responsible for IT security” is not enough. Nor can notes in the manual replace protective measures that the product itself needs.
A secure default configuration remains the manufacturer's task, where the corresponding CRA requirement applies. The operator still has to set up the product and integrate it securely. But the operator should not have to switch off unnecessary services first to reach a secure initial state.
The manufacturer must make clear what the product provides and what the operating environment has to add.
Where does your risk assessment stand?
Our readiness check shows you which foundations are in place and which next steps are due for CRA conformity.
The integrator: assess the risks of assembly
Components that were assessed individually do not automatically add up to a securely integrated line.
The integrator must check: Do the conditions of use of the modules fit together? Which connections are needed? Do shared networks or remote maintenance access paths create new risks?
Why the integrator? Because assembly can create risks that no individual component assessment covers.
The integrator must also clarify its legal role. A company that builds a complete packaging line from several modules can become the manufacturer of that line under machinery law. Whether manufacturer obligations under the CRA also arise depends on the resulting product and how it is made available.
“Integrator” is therefore not a fixed legal role. What counts is what the company actually builds, modifies, and makes available.
The operator: assess the risks to your own operations
The operator sees the labeling module as part of the plant. The operator needs to know what a failure or manipulation would lead to:
- Does only the module stop, or the entire packaging line?
- Could mislabeled products be processed further without anyone noticing?
- Does the remote maintenance access open a path to other systems?
This leads to measures for the actual operating environment: segmentation, access rules, controlled maintenance, and recovery procedures.
For entities within the scope of NIS2, appropriate technical, operational, and organizational cybersecurity risk-management measures are mandatory under the applicable national transposition rules. Outside this scope, a secure operating organization still makes sense.
Why the operator? Because only the operator knows the actual processes, dependencies, and consequences of a failure.
The operator should therefore ask the manufacturer for specific answers: Which protective functions does the product provide? Which conditions of use apply? Which measures does the operator have to add on site?
CRA, Machinery Regulation, and NIS2: different tasks, shared interfaces
The three sets of rules look at risks from different perspectives:
| Legal act | Who bears the main responsibility? | What must be considered? |
|---|---|---|
| CRA | Manufacturer of the product in scope | Cybersecurity risks of the product with digital elements |
| Machinery Regulation | Manufacturer of the machinery or partly completed machinery | Health and safety risks, including safety-relevant manipulation |
| NIS2 | Entity in scope | Risks to its network and information systems and their operation |
The interfaces matter. If someone manipulates the labeling module through the remote maintenance access, production can stop. If the manipulation triggers dangerous machine movements, it also affects machine safety.
The assessments therefore have to be coordinated. The product assessment alone does not answer how secure the whole plant is. Conversely, an operational risk assessment does not replace the manufacturer's obligations.
Standards and CE marking help, but do not replace your own assessment
IEC 62443-3-2 helps you divide an automation system into zones and conduits and assess its risks. A complete product-related CRA assessment does not follow from it automatically.
CE marking does not answer every question either. A partly completed machinery module can, for example, carry CE marking because of the CRA, even though it receives a declaration of incorporation under machinery law. The corresponding EU declaration of conformity shows which legislation the CE marking covers.
For the integrator and the operator, this means checking declarations and user information. Only these show which properties are assured and which conditions of use are assumed.
No one can wait for the others' assessment
Product development, integration, and plant planning often run in parallel. Information therefore has to flow in both directions. Responsibility still remains clear:
The manufacturer assesses the product. The integrator assesses how the parts work together. The operator assesses the use in its own operations.
Each needs information from the others. No one can hand over their own task to them completely.
For manufacturers, this means: assess your product, even if no customer asks for it.
How far along is your risk assessment as a manufacturer?
In a few minutes, you can see where your risk assessment for the product stands today and what is still missing for conformity.
