MITSUBISHI ELECTRIC Changes for the Better
DEEN
EN
GermanEnglish
Cyber Resilience Act in der Produktion
Factory Automation

Cyber Resilience Act (CRA): Security for production and IT

Topics

Ready for the EU Cyber Resilience Act

The Cyber Resilience Act (CRA) is an EU regulation that sets binding security requirements for products with digital elements. The aim is to embed cybersecurity in hardware and software from the outset (“security by design”) and to deal with security gaps professionally throughout the entire product life cycle. The regulation applies uniformly in all EU member states.

  • First EU regulation for minimum standards in cybersecurity
  • Applies to all networked products on the EU market (hardware and software)
  • Uniform rules for all member states
  • Implementation will take place gradually

CRA compatibility of our products – transparency for your planning

The EU Cyber Resilience Act establishes mandatory security standards for industrial products. Many of Mitsubishi Electric’s automation products are already being aligned with the CRA’s requirements to ensure long-term investment security and high cybersecurity standards. At the same time, not all existing product series will be fully CRA-compliant.

One reason for this is technical limitations, particularly hardware and design constraints of older generations. These cannot always be adapted to the new security requirements. For these series, we offer clear migration paths and long-term support so that you can modernize your systems in a timely and predictable manner.

Replacement parts for existing systems remain available and are not affected by the CRA requirements.

CRA-compliant: This applies to our products

Safety ex works

In future, our products will be developed according to the “secure by design” principle – with encrypted communication, minimized attack surface, and integrated vulnerability management. Mitsubishi Electric is thus not only complying with legal requirements, but also actively increasing the cyber resilience of production environments.

Secure default settings

We rely on “secure by default” – that means secure default settings, no weak default passwords, and hardware that can be updated.

Transparency & Verification

For CRA-compliant products, we will provide you with clear evidence of compliance in the future, including a declaration of conformity and, if necessary, test documentation. Operators and auditors will receive clear information about which components are included in the software and hardware, how updates are provided, and which security features are integrated. Audits will also become easier because uniform standards apply.

Quick response to security breaches

Identified vulnerabilities are reported via the official EU platform (EUVD)* and fixed as quickly as possible. This means you benefit from greater security and reliability.

Long-term support

We ensure that CRA-compliant products receive security updates and patch management throughout the entire support period—usually at least five years. This significantly increases cyber security, as the time between discovery and remediation of a vulnerability is critical for protection against attacks.

* Here you will find the European Union Vulnerability Database (EUVD), where vulnerabilities for the EU are centrally reported and documented.

Cybersecurity starts with the overall system

The Cyber Resilience Act considers not only individual components but also the security of the entire system. In industrial applications, cyber resilience is achieved through the secure interaction of all components. That is why Mitsubishi Electric takes a holistic approach to cybersecurity based on internationally established standards such as IEC 62443.

Safe Solutions for existing and new Machines

Not every machine requires a completely new design to meet current cybersecurity requirements. A system-oriented approach often allows existing investments to be protected while also addressing modern security requirements.

Your benefits:

  • Protection of existing capital investments
  • Reduced engineering effort
  • Standardized machine platforms
  • Integration of IT and OT
  • Future-proof machine architectures
  • Support in implementing regulatory requirements

FAQ

What is the Cyber Resilience Act?

The Cyber Resilience Act (CRA) is an EU regulation that introduces mandatory cybersecurity requirements for products with digital elements.

Manufacturers must consider security early on in the development process (“security by design”), provide secure updates, handle vulnerabilities responsibly, maintain a software bill of materials (SBOM), and keep technical documentation on hand. The goal is to make products in the EU more secure in the long term and protect users from cyber risks.

Has the Cyber Resilience Act already been passed?

Yes.

The Cyber Resilience Act was formally adopted and has been in force since December 11, 2024. It is therefore legally binding EU law.

What is the difference between NIS2 and the Cyber Resilience Act?

NIS2:

  • Directive for operators of essential or important services (e.g., energy, health, transportation, administration).
  • Focus: organizational IT security, risk management, incident reporting, supply chain security.
  • Applies to companies that operate critical or important services.

Cyber Resilience Act:

  • Regulation for manufacturers, importers, and distributors of products with digital elements, including software, IoT devices, or embedded systems.
  • Focus: secure product development, SBOM, vulnerability management, secure updates, technical documentation.
  • Applies to products provided on the EU market.

In short:

  • NIS2 regulates organizations,
  • the CRA regulates the products they use, manufacture, or distribute.
When does the Cyber Resilience Act have to be applied?

The regulation has been in force since December 11, 2024.

The specific application obligation begins after a transition period so that manufacturers can adapt their products, development processes, and documentation to the new requirements.

From September 11, 2026, there will be a mandatory reporting requirement for vulnerabilities and security incidents.

Products made available on the EU market from December 11, 2027, must comply with the CRA requirements.

We are happy to advise you personally!

The Cyber Resilience Act is a milestone for European industry. It defines clear standards for cyber security, ensures transparency in supply chains, protects operators, and strengthens the security of networked production systems. With secure development processes, state-of-the-art product architecture, and a strong focus on software quality, Mitsubishi Electric is consistently preparing its solutions for CRA compliance.

Cyberattacks will remain a threat. But with modern security, secure software, and consistent implementation of the Cyber Resilience Act, industrial plants can be operated in a stable, reliable, and resilient manner.

The fields marked by a * are mandatory.
  • Home
  • Cyber Resilience Act (CRA): Security for production and IT
Follow us
tm
© Mitsubishi Electric Europe B.V.