Product cyber & CRA
Secure-by-design compliance for connected products
EU Cyber Resilience Act, RED cybersecurity, IEC 62443, ETSI EN 303 645, and UL 2900 — threat modeling, SBOM, and evidence for market access.
What this engagement covers
Connected products increasingly need cybersecurity evidence alongside CE/FCC. We map applicable regimes (CRA, RED Delegated Regulation, IEC 62443, consumer IoT baselines), build a security requirements and testing plan, and structure SBOM / vulnerability-handling documentation so engineering and compliance share one story.
Best fit for
- IoT / IIoT OEMs selling into the EU under CRA / RED cyber
- Industrial control and OT device makers targeting IEC 62443
- Consumer connected products needing ETSI EN 303 645 / NISTIR baselines
- Teams preparing security evidence for retailers, utilities, or notified bodies
What's included
- Regulatory applicability map (CRA, RED cyber, sector schemes)
- Threat model & security objectives workshop
- Security requirements specification aligned to standards
- SBOM / vulnerability disclosure / update policy structure
- Penetration / vulnerability test plan coordination
- Technical documentation package for CE / customer audits
Product types we support
Scope changes by product architecture — these are the classes we regularly take through this pathway.
Consumer IoT
Cameras, hubs, smart appliances, wearables
Industrial gateways & PLCs
OT edge devices, protocol converters
Medical connected devices
Cyber overlays on 60601 / FDA expectations
Energy / EVSE / metering
Grid-adjacent and utility cybersecurity requirements
Radio equipment under RED
Internet-connectable radio products
Cloud-connected industrial sensors
Firmware update and identity/auth stacks
Technical categories
Control themes we document
Evidence artifacts
Regions & schemes
Market access is scheme-specific. We map filings and evidence to the regions you actually sell into.
European Union
- •Cyber Resilience Act (CRA)
- •RED Delegated Regulation (EU) 2022/30
- •EN 18031 series (as applicable)
- •Notified Body pathways when required
United States
- •FDA premarket cyber (medical)
- •NISTIR 8259 / customer baselines
- •UL 2900 when pursued
- •State IoT labeling laws as applicable
Industrial global
- •IEC 62443 certifications / assessments
- •ISASecure / IECEE schemes where used
UK / others
- •PSTI Act (consumer connectable)
- •ETSI EN 303 645 adoption
Directives & regulations
EU Cyber Resilience Act
Horizontal cyber requirements for products with digital elements
RED Delegated Regulation (EU) 2022/30
Cyber/privacy essential requirements for certain radio equipment
UK PSTI Act 2022
Consumer connectable product security
NIS2 (organizational interface)
Often drives customer security questionnaires to OEMs
Key standards
| Standard | Focus |
|---|---|
| ETSI EN 303 645 | Cybersecurity for consumer IoT |
| EN 18031-1/-2/-3 | Common security requirements for radio equipment (RED) |
| IEC 62443-4-1 / 4-2 | Secure product development & component requirements |
| IEC 62443-3-3 | System security requirements and security levels |
| UL 2900-1 / -2-x | Software cybersecurity for network-connectable products |
| NISTIR 8259 / 8259A/B | IoT device cybersecurity capability core baseline |
| ISO/IEC 27034 / 29147 / 30111 | Application security & vulnerability handling references |
Marks & program keywords
How we work
One clear path from classification to market-ready evidence.
Scope
Product class, connectivity, and applicable cyber regimes
Require
Security objectives, controls, and update strategy
Verify
Testing, SBOM, and vulnerability process evidence
Declare
Docs ready for CRA/RED/customer assessment
Engineering notes
CRA timelines and product categories determine whether you need self-assessment or third-party involvement — we classify early so roadmap and BOM decisions are realistic.
Radio CE without cyber evidence is increasingly incomplete for internet-connectable devices; we align RED cyber with your EMC/RF program.
Clear cyber regime map
Assessor-ready evidence
Fewer late security blockers
Ready to scope Cybersecurity?
30-minute consultation with Hazloc Labs — bring your product type, target markets, and any existing reports.
Book Free CallRelated services
CE Marking & UKCA
Directives, harmonized standards, testing coordination, and technical documentation — handled end to end for EU and UK market access.
EMC Compliance
Emissions and immunity strategy across residential, commercial, and industrial environments — before you burn expensive chamber days.
RF & Wireless Certification
FCC, RED, ISED, MIC, ACMA, and multi-country radio paths for modules, hosts, and custom radios — including antenna and SAR considerations.