Understanding the differences, overlap and practical implications for product manufacturers and industrial organizations
Many businesses that are creating a connected product or running an industrial system are typically subject to similar cybersecurity needs. There are several situations that may require a product manufacturer to evaluate compliance to the European Union's Cyber Resilience Act (CRA); the industrial deployment may require security practices aligned with IEC 62443; and the organization may employ ISO/IEC 27001 to manage information security risks. As implemented in the relevant Member State, if an organization is within the scope of NIS2, a number of further requirements are imposed on cybersecurity and incident management.
These systems are also associated with similar risks. They cannot substitute each other. These systems have different scope, purposes, parties involved, and evidentiary basis. By having an understanding of the differences between these two, an organization can then be able to understand their obligations and coordination of controls.
Cyber Resilience Act (CRA)
Cybersecurity for products
The CRA is an EU regulation for products with digital components which enter the EU market within the scope and excluding the scope of the regulation. It addresses the security requirements throughout the product life cycle, from secure design and development through to vulnerability management and security updates. Suitable conformity assessment procedures and CE marking depend upon the type of the product and the product classification.
Key Question: Does this product meet the cybersecurity requirements that apply to it, and can security be maintained throughout the required support period?
IEC 62443 Series
Security for industrial automation & control systems
The IEC 62443 series is dedicated to industrial automation and control systems (IACS) cyber security. It contains content of interest to various actors, such as product suppliers, system integrators and asset owners. It can be used to assist in secure product development, industrial risk assessment, system design, security requirements, zones and conduits, and operational security practices as relevant to the part deployed.
Key Question: How should components and industrial systems be designed, integrated and operated to manage cybersecurity risk in an operational technology (OT) environment?
Note: IEC 62443 is not a single universal certification that any company can obtain. It is a standard.ISO/IEC 27001
Information security management in the organisation
The ISO/IEC 27001:2022 standard defines the requirements for the implementation, maintenance, and continual improvement of the ISMS. The ISMS helps the organization manage information security risks using the approach of governance, risk assessment, policies, accountability, control, monitoring, and review.
Key Question: Does the organization manage information security systematically across the people, processes and technology within its ISMS scope?
Certification is one means of proving an ISMS has been third-party verified, but it will not necessarily prove that a product meets the CRA, nor that all NIS2 obligations were achieved.NIS2 Directive
Cybersecurity duties for covered entities
NIS2 is a directive by the European Union which provides cybersecurity risk management and reporting guidelines for covered organizations. These requirements cover various aspects, such as risk management, incident response, business continuity, and supply chain management.
Key Question: Is the organisation in NIS2's field of activity governed by national laws and, if it is, does it have incident-management and cybersecurity duties to fulfil?
Don't presume that NIS2 applies to all EU businesses, or that a business' applicability is just limited to a sector and size.| Framework | Primary focus | Typical scope / audience | Practical objective |
|---|---|---|---|
| CRA | Product cybersecurity | Manufacturers and other relevant economic operators placing products with digital elements on the EU market | Meet applicable product cybersecurity, vulnerability-handling and conformity obligations |
| IEC 62443 | Industrial automation and control system security | Product suppliers, integrators and industrial asset owners, depending on the relevant part | Manage security risks across industrial components, systems and operations |
| ISO/IEC 27001 | Organizational information security management | Organizations defining an ISMS scope | Manage information security risks through a systematic, continually improved ISMS |
| NIS2 | Cybersecurity obligations for covered entities | Entities within scope under applicable national law | Meet relevant risk-management, incident-handling and resilience obligations |
This is a high-level comparison, not a legal applicability assessment. Exact obligations depend on the product, organization, market, sector, national implementation and relevant legal provisions.
The frameworks can complement each other as they cover related areas of cybersecurity risk. While some risk assessment, vulnerability management, access control, secure development, incident response, documentation, and continuous improvement controls might have cross-applicability across multiple frameworks, a common control may not necessarily be able to fulfill all the specific requirements of all the frameworks.
Suppose a company writes an "Internet-connected" industrial controller for European customers, and its products could end up in industrial networks in Europe. It may be necessary to have different frameworks addressing various aspects of its business:
Product Development & Support – CRA Assessment
The manufacturer assesses whether the controller falls under the category of CRA and the product requirements relevant to the controller, has mechanisms to manage vulnerabilities, and creates the documentation for conformity assessment if needed.
Factory & OT Integration – IEC 62443 Assessment
Assessment of the industrial threat, architecture of the system, paths of access, network segmentation and operational security using appropriate IEC 62443 sections.
Company-wide Information Security – ISO/IEC 27001
The organisation manages the threats associated with their source codes, development tools, customer data, applications and other assets within their scope of ISMS.
Covered Services / Entity – NIS2 Assessment
An entity in the given scenario that falls under the scope of NIS2 based on the national laws conducts an assessment and complies with the obligations of cybersecurity and incident management associated with it.
A business may require collaboration between multiple frameworks, but the legal entity, product and system boundary and evidence requirements may vary. Compliance labelling should not replace this analysis.
The frameworks will not be satisfied merely through the implementation of certain technologies. The practices must be chosen based on the threat model, risk assessment, and architecture of the product in question.
| Engineering Practice | Description |
|---|---|
| 1. Threat modelling and risk assessment | Assets to be protected, attack vectors, trust boundaries and decision on risk mitigation. |
| 2. Secure boot and firmware integrity | Helps in stopping the execution of rogue firmware on supported hardware. |
| 3. SBOM and dependency management | Helps trace the software components more efficiently and determine which products have been affected by vulnerabilities. |
| 4. Vulnerability intake and mitigation | Linking reports and vulnerability information with triage, product impact, patching, disclosure and monitoring. |
| 5. Security testing | Perform analysis of code and dependencies, as well as testing and validation of systems. |
| 6. Industrial segmentation and access control | Reduce the paths of communications and restrict access in OT environment as needed. |
| 7. Incident response and recovery | Define roles, escalation procedures, incident communication and recovery actions and evidence preservation. |
The practices may serve as valuable evidence for implementation, but simply having the practices is not enough to ensure conformity and compliance. Match the practice and evidence to the requirement that it meets.
Define Scope
List of products, software, industrial systems, business services, target markets and relevant legal entities.
Applicability
Review product scope of CRA, applicable IEC parts of IEC 62443, scope and applicability of ISMS under national law, applicability of NIS2 under national law.
Develop Requirement-to-Control Matrix
Determine re-use of evidence and need for framework-specific evidence across teams and functions.
Assess Gaps and Prioritize
Record gaps, risks, owners, remediation actions, dependencies and deadlines.
Implement and Validate
Put in place and review engineering processes, system architecture, security operations and governance controls; test to ensure changes are working as intended.
Maintain Evidence and Monitor Change
Maintain versioned evidence and revisit the mapping when products, dependencies, deployments, vulnerabilities or legislation change.
A helpful mapping record will include the following information: the framework and requirement; the scope of the product or organization; the owner of the control; the status of implementation; evidence where it is located, residual risk; and next review date.
The CRA has come into force on 10 December 2024. The main obligations of the Act will take effect from 11 December 2027, and the reporting obligations for vulnerable incidents, including for those that are ‘acting on a vulnerability', will start from 11 September 2026 (as per the current information from the European Commission on implementation). Manufacturers should check the exact requirements and timelines applicable to their situation in accordance with the official guidance and legislation from the CRA.
For manufacturers of products, the compliance planning process should correlate regulatory interpretation with engineering execution. Ascenten can assist with relevant product engineering tasks, including embedded software development, secure product architecture, firmware update design, vulnerability management workflows, SBOM-related engineering, verification and validation.
A reasonable beginning point is to define what the product is, what the market will be, what requirements apply and where help with compliance is required, and what engineering tasks, evidence and ownership of the product will be. This enables teams to take the complete product lifecycle approach to security, rather than simply a documentation task at the end.
Build resilient and compliant connected products with Ascenten
Connect with our engineering team to assess your architecture, CRA readiness, and secure development lifecycle.
Connect with AscentenThe CRA, IEC 62443, ISO/IEC 27001, and NIS2 can help to tackle the same cybersecurity problems but in unique ways: product security, industrial system security, organizational information security management, and obligations for covered entities. They may interact with each other in their controls, but they have different legal ramifications and scopes.
A coordinated approach begins with establishing applicability, using mapping to link requirements to controls, reusing evidence as appropriate, and ensuring clear ownership and maintaining framework-specific traceability. The outcome is not a single certificate or checklist, but a security programme integrated from product engineering to industrial operations and organizational governance – without mixing up product and industrial responsibilities.
Contact Us
We would really like to hear from you and answer any questions. Please email us at info1@ascenten.net
or call us on
India Landline: +91-79-2646 4646
India Mobile: +91-89800 00973