Today's production lines increasingly consist of connected cyber-physical systems that integrate software, firmware, sensors, and digital platforms.
In this scenario, a software vulnerability is not only a cybersecurity risk. It can also compromise the operational safety of machines, disrupt production, and, in severe cases, create risks to operator safety.
To tackle these new challenges, the European Union has introduced a framework of three regulations that represent the pillars of an ecosystem aimed at industrial resilience, approaching cyber risk from complementary and interconnected perspectives:
NIS2 Directive (EU 2022/2555), strengthens the operational resilience of organizations.
Cyber Resilience Act - CRA (EU 2024/2847), ensures the cybersecurity of digital products and software.
Machinery Regulation (EU 2023/1230), protects the physical safety of operators.
ORGANIZATION
Responsibility of the OPERATOR
DIGITAL PRODUCT
Responsibility of the SOFTWARE/PLC MANUFACTURER
SAFETY
Responsibility of the MACHINE MANUFACTURER
Software is becoming one of the most critical elements in industrial risk management, as it is simultaneously part of safety (Machinery Regulation), part of the digital product (CRA), and part of the organization's IT/OT environment (NIS2). As a result, the industrial sector is undergoing a significant transformation: cybersecurity is no longer just an IT issue but is becoming an essential requirement for machine safety and access to the European market.
European NIS2 Directive
The European NIS2 Directive (EU 2022/2555), transposed into Italian law through Legislative Decree No. 138/2024, marks a significant shift in the way cybersecurity is conceived, managed, and governed within organizations. It applies to the machine operator/user, and its focus is the security of the organization's networks and information systems.
Among the key developments introduced by NIS2:
The introduction of direct, non-delegable legal responsibility for management bodies, subject to sanctions.
Risk assessment extended to the entire supply chain, with particular attention to critical suppliers.
Strict reporting deadlines for cyber incidents (24h/72h/1 month).
The measures required by NIS2 must be fully operational by 1 October 2026.
Euranet Services for NIS2 Compliance
With Euranet, the NIS2 compliance journey becomes a guided process. Starting with a gap analysis against NIS2 requirements and the ACN framework, we define a clear, organization-specific roadmap and support the implementation of the required measures, including cyber risk and incident management, the definition of management roles and responsibilities, and supplier risk controls.
Applicability assessment and identification of critical services
Evaluation of the organization's maturity level against NIS2 requirements and the ACN framework
Definition of a clear roadmap aligned with the organization's risk profile
Support in implementing the required measures
Discover how Euranet can guide your compliance journey
Cyber Resilience Act - CRA
The Cyber Resilience Act - CRA (Regulation EU 2024/2847) applies to hardware and software products with digital elements made available on the European Union market, including software and hardware components marketed separately.
The Regulation introduces new obligations for hardware and software manufacturers, including:
Security of products with digital elements throughout their entire lifecycle.
Security-by-design approach.
Identification, monitoring, and documentation of vulnerabilities and product components, including through SBOMs.
Reporting obligations for actively exploited vulnerabilities and severe incidents to ENISA and CSIRT within strict deadlines (24h/72h/14 days/1 month).
Mandatory detection and reporting of cybersecurity incidents.
Mandatory CE marking.
All CRA requirements must be in place by December 2027, with the first compliance deadlines taking effect in 2026 and penalties for non-compliance.
Euranet's CRA Compliance Services
The absence of a structured compliance framework can lead to delays, unexpected costs, and penalties. This is why Euranet provides ongoing support to help organizations maintain compliance over time and prepare for potential audits. In particular, Euranet supports organizations through a continuous consulting approach: starting with a training workshop, we identify the scope of applicability, analyze products and software, assess cybersecurity risks, and develop remediation and incident reporting plans. This process leads to the definition of a Cybersecurity Management System that supports the implementation of the required measures, including product requirements (Annex I) and organizational obligations.
Hands-on Workshop (3h+3h/online or on-site): training on CRA and preliminary compliance assessment
CRA scope: identification of the products, software, and digital components falling within the scope of the Regulation
Software analysis: identification and documentation of vulnerabilities, SBOM, software licenses, cybersecurity risks etc. with the option to integrate CAST Software Intelligence solutions
Remediation plan: product remediation to reduce risks, improve the security architecture, strengthen configurations, implement updates, enhance access controls, etc.
Vulnerability handling and incident reporting: definition of a process to manage vulnerabilities, reports, patches, customer communications, and severe incidents
Cybersecurity Management System: implementation of a structured system of roles, procedures, controls, evidence, periodic reviews, and continuous improvement
Discover how Euranet can guide your compliance journey
Schedule a Workshop to get started with CRA compliance
Machinery Regulation
With the adoption of the Machinery Regulation (EU 2023/1230), cybersecurity has become an integral part of machinery health and safety requirements within the European Union. Alongside the assessment of physical risks (governed by ISO 12100), the Regulation introduces the obligation for manufacturers to protect machinery digital systems against corruption that could compromise safety (Security by Design in support of safety), in accordance with EN 50742. The objective is to ensure that no digital compromise can create a risk to people's health and safety.
The EN 50742 standard (Safety of machinery – Protection against corruption) defines cybersecurity requirements for industrial machinery, focusing on safeguarding the physical safety of operators against digital tampering. It applies to digital elements (hardware and software) whose malfunction or corruption may directly or indirectly affect the physical safety of the machine (safety-relevant digital elements) and introduces the requirement for manufacturers to perform Threat Modeling.
The outcome is the EN 50742 Cybersecurity-Safety Dossier, which includes, among other elements:
An inventory of safety-relevant digital elements.
Cyber-safety protection procedures, including secure software updates and remote access management.
Traceability of modifications through logging systems.
Clear cybersecurity requirements in the machinery user manual.
Identification and documentation of cyber threats and software security vulnerabilities affecting safety.
Assessment of the associated cyber-physical risks and implementation of appropriate risk mitigation measures.
These elements must be documented in the machine's Technical File as evidence of conformity for the certification authorities, becoming an integral part of the CE marking process.
The Regulation will become mandatory on 20 January 2027, by then, manufacturers will be required to demonstrate compliance.
Euranet's EN 50742 Compliance Services for the Machinery Regulation
To help manufacturers meet the new requirements, Euranet guides organizations through a clear and practical compliance journey, providing continuous consulting and ongoing monitoring to help them maintain compliance over time. Starting with a hands-on workshop, we identify the safety-relevant digital elements, perform a gap analysis and an integrated threat assessment, develop a remediation plan together with the required documentation updates, and support the preparation of the EN 50742 Cybersecurity-Safety Dossier.
Workshop (1 day):
preliminary risk mapping
Scope Definition and Inventory: identification of digital elements and classification of safety-relevant elements
Assessment and Gap Analysis: review of access controls, logging, and technical documentation
Integrated Threat Assessment: development of a threat register, including residual risk assessment
Remediation Plan:
definition of system hardening measures, access controls, secure update procedures, and password policies
Documentation Updates: preparation of the compliance matrix, remote access procedures, and customer documentation
Final Verification and Support:
final verification testing, gap closure
Discover how Euranet can guide your compliance journey
Medical Devices
Manufacturers of medical devices are also subject to strict requirements to ensure the cybersecurity of embedded software, essential for protecting the availability, integrity, and confidentiality of data. In particular, these requirements are set out in:
EU Medical Device Regulation (MDR) – Regulation (EU) 2017/745.
FDA regulatory requirements for Medical Devices and Cyber-risk Management.
EURANET & CAST
Organizations that adopt an integrated approach to software security will be better prepared to address emerging regulatory and technological challenges. Thanks to its partnership with CAST Italia, Euranet supports manufacturers of machinery with digital components and medical devices in managing the growing regulatory complexity of cybersecurity through the structural analysis of industrial and embedded software. By combining Euranet's expertise in asset protection and cybersecurity standards and regulations with CAST's technology, organizations can prevent operational risks and measure software productivity and security.
Standard di riferimento:
Watch the highlights of Euranet & CAST’s webinar to learn more about NIS2, CRA and the Machinery Regulation.
Standard di riferimento:
Compliance is not a one-time event but a continuous process. Euranet supports you with a clear and structured path towards a verifiable cybersecurity architecture and long-term resilience in the global marketplace.
Euranet S.r.l. Registered Office: Via Boccaccio 20, 20123 Milan, Italy – Operational Office: Via Cavour 5, 27043 Broni (PV), Italy – Share Capital €64,100 fully paid-up – VAT No. 12270030153 – Registered with the Milan Companies Register, REA MI-1544390
This website uses cookies to enhance your browsing experience. By clicking “Accept”, you consent to the use of all cookies. If you choose to decline or close this banner, you may still browse the website; however, some features may not be available. For more information, please refer to our Cookie Policy.
You can withdraw your consent at any time using the “Withdraw consent” button.
