Cyber Resilience Act

EU cyber resilience regulation could mean millions in fines

Industrial networks and critical infrastructures require special protection. According to the European Union, there is currently a ransomware attack every eleven seconds. To hold manufacturers, distributors and importers accountable, they face stiff penalties if security vulnerabilities in devices are discovered and not properly reported and closed. "The pressure on the industry - manufacturers, distributors and importers - is growing immensely. The EU will implement this regulation without compromise, even if there are still some steps to be taken, for example with the local state authorities," says Jan Wendenburg, CEO of Onekey. The penalties for affected manufacturers are high: up to 15 million euros or 2.5 percent of global annual sales in the past fiscal year - the larger number counts.

"This makes it unmistakably clear that manufacturers face severe penalties if they fail to implement the requirements," said Wendenburg. The European Commission's proposal provides for the requirements to apply as early as 24 months after the regulation comes into force. Individual elements, such as the obligation to report safety incidents, are to apply after just 12 months. "The time horizon is tight, considering that orders for IT products are already being placed with OEM manufacturers this year for the coming 12 to 18 months. Therefore, the time situation must be considered and resolved now, before a product ends up not being launched on the market due to defects or the market launch is delayed," explains Jan Wendenburg.

The company Onekey operates a firmware analysis platform for finding security vulnerabilities in smart and connected devices, from vacuum cleaner robots to industrial control systems worth millions. With a Cyber Resilience Readiness Assessment, they offer the possibility for manufacturers, distributors and importers to already check their products for essential requirements of the Cyber Resilience Act and furthermore to investigate security gaps and also to fill the SBOM (Software Bill of Materials) required by the EU Commission with content.