IT, OT & PRODUCT CYBERSECURITY
Connected products and production systems are now attack surfaces. Ransomware stops factories, vulnerable devices become entry points, and an attack on a machine or a vehicle can quickly turn into a safety problem. Industrial networks and control systems (OT) need different methods than office IT, because availability and safety come first.
Regulation has caught up, with rules for products placed on the EU market (Cyber Resilience Act, Radio Equipment Directive, Machinery Regulation, UN R155 and R156 for vehicles) and obligations for the organisations that run networks and essential services (NIS2).
CertX helps manufacturers, integrators and operators turn these requirements into engineering practice, and demonstrates the result with independent assessments and certification, in three areas:
- IT cybersecurity: information and business systems
- OT cybersecurity: industrial control systems, production lines and infrastructure
- Product cybersecurity: devices, machines, vehicles and software placed on the market
It takes 20 years to build a reputation and a few minutes for a hacker to ruin it. CertX strengthens your defence.
A holistic and pragmatic approach
Cybersecurity is not only a matter of strong technology. Attackers target the weakest link, which is often a process or a person. We therefore assess products, processes and people together: phishing exploits human weakness, and awareness programmes are part of the countermeasures.
IT cybersecurity
IT security protects information and business systems: networks, servers, workstations, cloud services and the data they hold. Their confidentiality, integrity and availability depend as much on processes and people as on technology.
Requirements and standards
- NIS2 (EU) 2022/2555: cybersecurity risk management, incident response and incident reporting for essential and important entities. Member states had to transpose it by 17 October 2024 and list their entities by 17 April 2025; reporting obligations start with national transposition. There is no harmonised standard; ISO/IEC 27001 is a strong baseline.
- GDPR: security of personal data
- ISO/IEC 27001 and the NIST Cybersecurity Framework
What we do
- Awareness programmes for staff and managers, against phishing and other attacks on people. See our IT security awareness course.
- Gap analysis and compliance check of processes and management systems against ISO/IEC 27001, the NIST Cybersecurity Framework and NIS2.
- Architecture review, vulnerability analysis and testing of infrastructure against attack attempts.
OT cybersecurity
OT security protects physical processes such as machines, production lines and infrastructure. Availability and safety come first, systems run for many years and patches cannot always be installed immediately. ISA/IEC 62443 was written for these constraints.
Requirements and standards
- NIS2 for operators of essential and important services, such as energy, transport and manufacturing; ISA/IEC 62443-2-1 is a strong baseline for the security programme of asset owners.
- ISA/IEC 62443, including IEC 62443-2-1 (security program for asset owners), IEC 62443-2-4 (security program for service providers) and IEC 62443-3-3 (system security requirements)
- CLC/TS 50701 for railway applications
What we do
- Awareness and training: OT security awareness and the ISA/IEC 62443 Red Belt course.
- Gap analysis, compliance check and certification of systems against IEC 62443-3-3.
- Threat analysis and risk assessment, architecture review, vulnerability analysis and testing of industrial networks and control systems.
Product cybersecurity
Products with digital elements, from connected devices and industrial controllers to machines, vehicles, medical devices and software, must be secure by design and stay secure over their lifetime, from design to end of support.
Requirements and standards
- Cyber Resilience Act (EU) 2024/2847, in force since 10 December 2024, for products with digital elements sold in the EU: reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026, all other requirements from 11 December 2027. Harmonised standards are still being developed; until then, ISA/IEC 62443-4-1 and 4-2, BSI TR-03183 and ETSI EN 303 645 represent the state of the art.
- Radio Equipment Directive 2014/53/EU: the delegated act (EU) 2022/30 has applied to connected radio equipment since 1 August 2025. Its harmonised standards, the EN 18031 series, are published.
- Machinery Regulation (EU) 2023/1230, applicable from 20 January 2027: protection of control systems against corruption.
- UN R155 and R156 for vehicles (ISO/SAE 21434, ISO 24089).
- MDR/IVDR for medical devices (IEC 81001-5-1).
- Also: ISO/IEC 15408 (Common Criteria), EUROCAE ED-202A/ED-203A.
What we do
- Awareness and training: Red Belt courses on ISA/IEC 62443 and ISO/SAE 21434, and CRA training with SGS Academy.
- Gap analysis, compliance check and certification of products and development processes against IEC 62443-4-1 (secure development lifecycle), IEC 62443-4-2 (component requirements), ISO/SAE 21434, EN 18031 and the CRA essential requirements.
- Technical evaluation and testing: threat analysis and risk assessment (TARA), architecture review, vulnerability analysis and testing of products against attack attempts.
- Supporting services: CRA readiness, vulnerability handling and coordinated disclosure, SBOM, secure update processes and technical documentation.
Example: Mikron Automation, certified to ISA/IEC 62443-4-1 by CertX. Read our article on the Cyber Resilience Act.
Not sure which of these regulations apply to your product? Our questionnaire on the CRA, the RED and the Machinery Regulation gives you a first answer.
Cybersecurity across industries
Whether you supply medical devices, integrate safety-critical systems into vehicles or operate critical infrastructure, the methods are similar and the constraints differ. Our team works across sectors and knows their specific requirements.
- Sectors: automotive, railway, aerospace, medical devices, energy, industrial automation and machinery
- Regulations: Cyber Resilience Act, Radio Equipment Directive, NIS2, Machinery Regulation, UN R155/R156, MDR/IVDR, GDPR
- Standards: ISA/IEC 62443, ISO/SAE 21434, ISO 24089, EN 18031, ISO/IEC 27001, ISO/IEC 15408 (Common Criteria), CLC/TS 50701, IEC 81001-5-1, NIST Cybersecurity Framework, EUROCAE ED-202A/ED-203A
See our industry pages.
Services from awareness to certification
For IT, OT and products alike, we support your roadmap for secure development and operation in four streams:
- Awareness and training. See our training page.
- Gap analysis, compliance check and certification of products, processes and management systems.
- Technical evaluation and testing of products and infrastructure.
- Supporting services for regulatory readiness and documentation.
Frequently asked questions
Does the Cyber Resilience Act apply to my product?
The CRA applies to products with digital elements made available on the EU market whose intended use includes a data connection to a device or a network, from connected machines and industrial controllers to apps and software. Products covered by specific rules, such as medical devices and vehicles, are excluded. Reporting obligations apply from 11 September 2026, all other requirements from 11 December 2027.
Do I need a third-party assessment under the CRA?
Most products can be assessed by the manufacturer itself. Important products of class I can use internal control only if they fully apply harmonised standards, common specifications or a European certification scheme; otherwise, and for important products of class II, a notified body must be involved. Critical products may require a European cybersecurity certificate. We help you classify your product and prepare the evidence.
How does IEC 62443 relate to the CRA?
Harmonised standards for the CRA are still being developed. IEC 62443-4-1 (secure product development lifecycle) and IEC 62443-4-2 (technical requirements for components) already cover a large part of the essential requirements and are a strong basis for compliance.
Can my product fall under several regulations?
Yes. A connected machine can fall under the Machinery Regulation and the Cyber Resilience Act at the same time, and a product with a radio module under the Radio Equipment Directive. If your customers operate in critical sectors, they will also ask you for evidence for NIS2. One assessment across all applicable regulations reduces the effort.
What about products already on the market?
New rules apply from their date of application. Products placed on the market before that date follow the rules in force at the time, for example the Machinery Directive 2006/42/EC; products placed on the market after it must meet the new requirements. Exception: the CRA reporting obligations of September 2026 also cover products already on the market.
I sell in Switzerland. Does this apply to me?
The EU rules apply to every product placed on the EU market, whatever the country of the manufacturer. Switzerland takes over some of them, such as the cybersecurity requirements for radio equipment through the Ordinance on Telecommunications Installations.
What is the difference between IT and OT security?
IT security protects information and business systems. OT security protects physical processes such as machines, production lines and infrastructure, where availability and safety come first, systems run for many years and patches cannot always be installed immediately. IEC 62443 was written for these constraints.
CONTACT US
Send us the form to contact Loan Bétend, Head of Cybersecurity at CertX.