Joint statement – Cyber Resilience Act: Timely Citation of Harmonised Standards Essential for a Secure and Competitive European Industry

European industry strongly supports the objectives of the Cyber Resilience Act (CRA). For its effective and timely implementation in the area of Operational Technology (OT), 23 organisations call on the European Commission to swiftly cite the upcoming EN IEC 62443 harmonised standards (broad verticals and vertical standards) in the Official Journal of the European Union (OJEU) once they have been submitted by CENELEC for citation.

OT underpins Europe’s manufacturing, energy, water, transport and process industries. For over 15 years, European manufacturers, system integrators, and operators have built secure development processes and product security requirements on IEC 62443-4-1 and -4-2 and its European equivalents. It is embedded in certification schemes, procurement and supply chain contracts, and regulatory regimes worldwide, supported by a large community of trained and certified professionals. EN IEC 62443 encapsulates the state of the art for OT products. Manufacturers, authorities and conformity assessment bodies rely on it today, and will continue to do so in the future.

These standards are now being adapted in Europe in order to also address the requirements of the CRA. From the two “broad verticals”, several “vertical standards” are being derived to address relevant OT-related CRA products (Class I and Class II). This directly responds to the CRA Standardisation Request (M/606) to leverage existing international work by aligning with CRA essential requirements and preserving the link to the IEC international series.

To read the joint statement in full, please download the document above.