xxxxxxxxx

cra-compliance

Regulation (EU) 2024/2847 makes cybersecurity mandatory for all products with digital elements on the EU market. The reporting requirements for vulnerabilities and incidents take effect on September 11, 2026, and full compliance is required as of December 11, 2027. We support you every step of the way—from risk assessment and secure development to the technical dossier. We also bring existing products up to the required standard.

get in touch

AS A SOLUTION AND SYSTEM PROVIDER, WE BRING YOUR IDEAS TO LIFE!

01

Risk Assessment & Threat Modeling

We deliver robust, reliable, and cost-effective hardware precisely tailored to your requirements.

learn more

02

Secure Development & SBOM

Our developers offer our clients more than just code. Because good software simplifies complex devices and systems.

learn more

03

Operations & Reporting Obligations

Firmware gives your hardware intelligence and brings it to life. We develop individual firmware solutions and program custom applications.

learn more

04

Updating legacy products

Our systems integrate seamlessly into your existing infrastructure and work together perfectly. This allows us to achieve maximum performance, efficiency, and reliability.

learn more

your path to market-ready electronics, with comprehensive support
CE-Reife

Through the perfect interplay of functional hardware, suitable firmware, and modular software, we transform complex challenges into simple solutions.
Wir wählen den kürzeren und gehen ihn mit Ihnen.
start Inquiry
1

hardware development

- Requirements Specification
Die Risikobewertung nach Art. 13(2) wird erstellt: Für jeden Asset werden Bedrohungsszenarien bewertet und Gegenmaßnahmen definiert.
- Prüfung des Anwendungsbereichs und Klassifizierung
- Ableitung des Konformitätswegs: Eigenbewertung oder notifizierte Stelle
- Cybersecurity-Risikobewertung nach Art. 13(2)
- Threat Modeling mit konkreten Angriffsszenarien
2

software development

- Software Design and Architecture
Parallel entstehen die maschinenlesbare SBOM und die Nachweise für das technische Dossier.
- Secure by Design und Secure by Default
- Secure Boot, verschlüsselte Kommunikation, signierte OTA-Updates
- Maschinenlesbare SBOM, automatisiert im Build
- Orientierung an relevanten Normen wie ISA/IEC 62443, ETSI EN 303 645, etc.
- Technisches Dossier nach Anhang VII
‍
3

firmware

- Design and implementation of firmware modules and functions according to specifications
- Sicherheitsupdates über den Supportzeitraum von mindestens fünf Jahre
- Aktualisierte SBOM je Release mit CVE-Abgleich
- Kontinuierliche Schwachstellenüberwachung
- Fristgerechte Meldung an ENISA und nationales CSIRT: Frühwarnung binnen 24 Stunden, Meldung binnen 72 Stunden, Abschlussbericht binnen 14 Tagen
- CRA-gerechte Wartungsverträge
4

solution and system development

- Holistic development of complex electronic systems and complete solutions
Im Gap Assessment bewerten wir den Ist-Zustand und liefern einen priorisierten Maßnahmenplan mit Aufwands- und Terminschätzung.
Die Umsetzung übernehmen wir bis zur CE-Reife und dies auch für Software, die nicht bei uns entstanden ist.
- Gap Assessment gegen die CRA-Anforderungen
- Nachträgliche Erstellung der SBOM aus bestehendem Code
- Priorisierter Maßnahmenplan mit Aufwands- und Terminschätzung
- Umsetzung, Test und Validierung bis zur CE-Reife

case study

Pump Control: Cybersecurity under the CRA


‍Technologies: Microcontrollers, BLE, OTA updates, Secure Boot, encrypted communication, SBOM generation during build
‍
Challenge: A pump system controller, configurable via app over BLE and field-upgradable, falls under the scope of the Cyber Resilience Act. We determined the regulatory classification in collaboration with the client. Our task was the technical implementation: embedding the derived requirements into the firmware and development process.
‍
‍Solution: We assessed threat scenarios for the BLE channel, authentication, firmware integrity, and physical access, and derived technical measures accordingly. We implemented Secure Boot with signature verification prior to execution, encrypted communication without plaintext pairing, and encrypted OTA updates. The machine-readable SBOM is generated automatically during the build process and updated with every release, supplemented by cross-referencing the components used against known vulnerabilities.
‍
Result: Security requirements are firmly embedded in the product.