Does the Cyber Resilience Act Apply to Industrial Control Systems (ICS)?
Learn if the EU CRA applies to Industrial Control Systems (ICS), what the core compliance requirements are, and how to start preparing your engineering teams automatically.
Core Definition
Yes. The EU Cyber Resilience Act applies directly to Industrial Control Systems (ICS) as they fall under the definition of "products with digital elements." PLCs are not listed as such in Annex III or IV, so a PLC is an important product only if its core functionality matches an Annex III category (Article 7(1)); integrating a listed component, such as a microcontroller with security-related functionalities, does not by itself change the PLC's class. This means your hardware must meet mandatory cybersecurity requirements to be distributed in the EU market.
Key Compliance Steps for Industrial Control Systems (ICS)
- Determine Classification: Check if your Industrial Control Systems (ICS) falls under the default category, an important class (Annex III, class I or II) or the critical list (Annex IV), which dictate stricter conformity assessment paths.
- Perform Risk Assessment: Map out the attack surface for your hardware and physical components and document the mitigations for the "secure by design" requirement.
- Implement Vulnerability Reporting: Provide a 24-hour reporting mechanism to ENISA for actively exploited vulnerabilities.
- Generate an SBOM: Ensure all dependencies used in your Industrial Control Systems (ICS) are documented in a machine-readable Software Bill of Materials.
- Avoid the Common Pitfall: Assuming IEC 62443 certification alone satisfies CRA — it helps but doesn't automatically confer presumption of conformity.
How This Plays Out in Practice
PLCs are not listed as such in Annex III or IV, so a PLC is an important product only if its core functionality matches an Annex III category (Article 7(1)); integrating a listed component, such as a microcontroller with security-related functionalities, does not by itself change the PLC's class.
What to Watch For
Assuming IEC 62443 certification alone satisfies CRA — it helps but doesn't automatically confer presumption of conformity.
Assess Your CRA Readiness
Evaluate your product's Cyber Resilience Act readiness using our interactive tool. Find exactly which of the 22 security requirements apply directly to Industrial Control Systems (ICS).