Cyber Resilience Act: Timely Citation of Harmonised Standards Essential for a Secure and Competitive European Industry

European industry strongly supports the objectives of the Cyber Resilience Act (CRA) [1]. For its effective and timely implementation in the area of Operational Technology (OT), the undersigned 23 organisations call on the European Commission to swiftly cite the upcoming EN IEC 62443 harmonised standards (broad verticals and vertical standards) in the Official Journal of the European Union (OJEU) once they have been submitted by CENELEC for citation.

OT underpins Europe’s manufacturing, energy, water, transport and process industries. For over 15 years, European manufacturers, system integrators, and operators have built secure development processes and product security requirements on IEC 62443-4-1 and -4-2 and its European equivalents. It is embedded in certification schemes, procurement and supply chain contracts, and regulatory regimes worldwide, supported by a large community of trained and certified professionals. EN IEC 62443 encapsulates the state of the art for OT products. Manufacturers, authorities and conformity assessment bodies rely on it today, and will continue to do so in the future.

These standards are now being adapted in Europe in order to also address the requirements of the CRA. From the two “broad verticals” [2], several “vertical standards” [3] are being derived to address relevant OT-related CRA products (Class I and Class II). This directly responds to the CRA Standardisation Request (M/606)4 to leverage existing international work by aligning with CRA essential requirements and preserving the link to the IEC international series.

[1] Regulation (EU) 2024/2847

[2] The broad verticals enable manufacturers to assess all the risks of a product, covering the full set of security and lifecycle requirements (going beyond M/606, which requires the broad verticals to “provide at least partial coverage of the risks”)

[3] The vertical standards focus on the product’s core functionality. Other functions are covered by the broad verticals. The citation of the broad verticals would notably ensure that the product as a whole can benefit from presumption of conformity.

[4] C(2025)618 – Register of Commission Documents