Powering Intelligence at the Edge

Understanding the EU Cyber Resilience Act

The Cyber Resilience Act, Regulation (EU) 2024/2847, establishes cybersecurity requirements for products with digital elements placed on the EU market. It generally covers hardware and software whose intended or reasonably foreseeable use includes a direct or indirect connection to a device or network.

The CRA addresses cybersecurity throughout product design, development, production, and the applicable support period. Key requirements include:

• Secure design and risk assessment: Identifying cybersecurity risks and implementing safeguards appropriate to the product’s intended use.
• Vulnerability handling: Identifying, assessing, and addressing vulnerabilities affecting product security.
• Security updates: Providing necessary security fixes during the applicable support period.
• Software component transparency: Documenting software components to enable traceability and vulnerability assessment.
• Technical documentation and user information: Preparing conformity assessment documentation and guidance for secure deployment and maintenance.
• Regulatory reporting: Reporting actively exploited vulnerabilities and severe security incidents.

Key Implementation Dates

SINTRONES’ Cybersecurity Foundations

Certified Secure Product Development

SINTRONES’ secure product development lifecycle is certified to IEC 62443-4-1. The standard covers security requirements, secure design and implementation, verification and validation, security issue management, security update management, and security guidance.

This provides a structured foundation for addressing cybersecurity throughout product development and maintenance.

Information Security Management

SINTRONES holds ISO 27001 certification for its information security management system, providing an organizational framework for managing information security risks alongside secure product development.

Product Security Incident Response

SINTRONES PSIRT manages and responds to reported product security vulnerabilities. Customers, security researchers, and partners can report suspected vulnerabilities directly to PSIRT@sintrones.com.

Security Advisories

The SINTRONES Security Advisories page provides a dedicated channel for product security information, and vulnerability-related announcements. 

Key Areas for CRA Alignment

Secure Design and Risk Assessment

Secure development and risk assessment are central to CRA readiness. Relevant considerations include intended use, connectivity, access control, secure configuration, interface exposure, and firmware and software integrity.

These factors help identity potential security risks and guide product design, security controls, and deployment recommendations. 

Vulnerability Handling and Reporting

Effective vulnerability handling involves receiving reports, assessing potential impact, identifying appropriate corrective actions, and communicating relevant information.

SINTRONES PSIRT manages reports of suspected vulnerabilities affecting SINTRONES products. Customers, partners, and security researchers can contact PSIRT@sintrones.com.

The CRA also requires manufacturers to report actively exploited vulnerabilities and severe incidents affecting the security of covered products through the EU Single Reporting Platform. This regulatory process is separate from reporting suspected vulnerabilities to SINTRONES PSIRT.

Security Updates and Lifecycle Management

The CRA requires manufacturers to address vulnerabilities during the applicable support period. Security maintenance includes corrective updates, mitigation measures, update instructions, and clear lifecycle information.

The CRA generally requires a support period of at least five years, or the expected product lifetime where that is shorter. For product-specific security support information, please contact SINTRONES.

SINTRONES’ Security Advisories page provides an official channel for communicating product security information.

Software Component Transparency

Software component records support vulnerability tracking and impact assessment across firmware, drivers, libraries, and third-party software.

The CRA requires manufacturers to identify and document components, including through a Software Bill of Materials (SBOM) covering at least top-level dependencies. Component traceability supports assessment of potentially affected versions when vulnerabilities are disclosed.

Customer Security Information

Clear security guidance enables customers to install, configure, operate, update, and decommission products securely.

Relevant topics include access permissions, network configuration, update procedures, and data removal. Clear guidance helps customers configure and operate products more securely in their own environments.

Reporting a Security Vulnerability

Please report suspected vulnerabilities affecting SINTRONES products to:

PSIRT@sintrones.com

To facilitate assessment, include:

• Product model.
• Relevant firmware or software versions.
• A description of the issue and potential impact.
• Reproduction steps or relevant logs, where available.
• Contact information for follow-up communication.

For product security information, visit the SINTRONES Security Advisories page.

Frequently Asked Questions

1. What is the CRA, and why is it relevant to industrial computing?

The CRA establishes cybersecurity requirements for connected hardware and software placed on the EU market. Industrial computing platforms may fall within its scope because they connect to equipment, networks, and software systems.

Its requirements address product security throughout development and the applicable support period, including vulnerability handling and security updates.

2. When do CRA requirements apply?

The CRA entered into force on December 10, 2024. Reporting obligations began to apply on September 11, 2026, and the principal requirements apply from December 11, 2027.

3. Which manufacturers need to consider the CRA?

Manufacturers placing covered products on the EU market must consider the CRA, including manufacturers based outside the EU. Importers and distributors also have responsibilities under the regulation.

4. What types of connectivity are covered?

The CRA covers direct and indirect connections to devices or networks. Relevant connectivity can include local networks, connections through other equipment, and direct internet access.

5. What cybersecurity foundations has SINTRONES established?

SINTRONES holds IEC 62443-4-1 and ISO 27001 certifications, maintains a PSIRT, and provides a dedicated vulnerability reporting email address and Security Advisories page.

Together, these address secure development, organizational information security, and product vulnerability response.

6. What does IEC 62443-4-1 cover?

IEC 62443-4-1 addresses secure product development for industrial automation and control systems.

It covers security requirements, design, implementation, verification and validation, security issue handling, update management, and security guidance.

7. How does ISO 27001 contribute to cybersecurity?

ISO 27001 provides a framework for managing organizational information security risks. It complements secure product development by addressing how information security is governed and managed within the organization.

8. How are third-party software vulnerabilities assessed?

Assessment may consider the component version, affected functionality, product configuration, exposure, and potential impact. These factors help determine whether a reported issue is relevant to a product and what corrective action may be appropriate.

9. What is an SBOM used for?

An SBOM records software components and related information. It enables component traceability and assists in identifying products that may be affected when a software vulnerability is disclosed.

This information provides a foundation for vulnerability investigation and remediation planning.

10. How does the CRA address products already on the EU market?

Products with digital elements placed on the EU market before December 11, 2027 are generally subject to the CRA’s principal requirements if they undergo a substantial modification on or after that date. The CRA’s reporting obligations also apply to in-scope products placed on the EU market before December 11, 2027.

11. What should system integrators consider when deploying SINTRONES products?

The security of an integrated system depends on more than the computing hardware alone. System integrators should also consider the operating system, applications, network configuration, connected devices, access controls, and update procedures used in the final deployment. Changes made during integration may affect the system’s security risks and responsibilities.

12. How can customers report vulnerabilities and find security information?

Report suspected vulnerabilities to PSIRT@sintrones.com, including the product model, relevant versions, issue description, and available reproduction information.Visit the SINTRONES Security Advisories page for product security information and vulnerability related announcements.

13. Does IEC 62443-4-1 certification mean a product is CRA compliant?

IEC 62443-4-1 certification relates to secure product development processes. It does not, by itself, establish that a specific product meets all applicable CRA requirements.

14. Are SINTRONES industrial and edge AI computers subject to the CRA?

The CRA may apply to industrial and edge AI computers that qualify as products with digital elements and are placed on the EU market. Applicability depends on the specific product, its intended use, connectivity, and relevant regulatory provisions. For questions about a specific SINTRONES product, please contact our team.

Questions About Product Cybersecurity?

For product-specific security information, please contact the SINTRONES team at https://www.sintrones.com/service-support/product-inquiry/. To report a suspected vulnerability, contact PSIRT@sintrones.com. For product security information, visit https://www.sintrones.com/service-support/security-advisories/.

Regulatory reference: Regulation (EU) 2024/2847 and the European Commission’s CRA reporting guidance. Last reviewed: October 27, 2026.