{"id":12406,"date":"2024-10-30T13:46:27","date_gmt":"2024-10-30T12:46:27","guid":{"rendered":"https:\/\/future-markets-magazine.com\/?p=12406"},"modified":"2024-11-06T10:06:19","modified_gmt":"2024-11-06T09:06:19","slug":"how-the-eu-cyber-resilience-act-will-work","status":"publish","type":"post","link":"https:\/\/future-markets-magazine.com\/en\/markets-technology-en\/all-electric-society\/how-the-eu-cyber-resilience-act-will-work\/","title":{"rendered":"How the EU Cyber Resilience Act will Work in Practice"},"content":{"rendered":"

With the Cyber Resilience Act, a significant step is being taken to strengthen cybersecurity<\/a> in Europe. It will apply to all connected products, including components of the All Electric Society, which are increasingly exposed to cyberattacks. <\/b><\/span><\/p>\n

According to the International Energy Agency (IEA), the number of cyberattacks on energy utilities worldwide more than doubled between 2020 and 2022. Recently, incidents have included the deactivation of wind farm remote monitoring, outages of electricity meters due to unavailable IT systems, and hacking of data such as customer names, addresses, bank details, and phone numbers. Globally, the average cost of a data breach in the energy sector reached a new record high of 4.72 million US dollars in 2022.<\/p>\n

Security from the Start<\/b><\/span><\/h2>\n

“The need for cybersecurity<\/a> affects the entire power grid, including distribution networks, transmission networks, and the connected renewable energy sources,” explains Frances Cleveland, Head of Cybersecurity<\/a> within the IEC\/TC 57 technical committee of the International Electrotechnical Commission (IEC). The committee publishes fundamental standards for the Smart Grid<\/a>, such as the IEC 62351 series. In addition to cybersecurity<\/a> requirements, it also includes guidelines for considering security requirements in systems and operations during the development phase, so that security measures are not only implemented once the systems are already in operation.<\/p>\n

\n

“The goal is to ensure that participants in the distributed energy resources (DER) sector manufacture and connect these DER systems in a way that incorporates cybersecurity<\/a> measures and technologies from the outset, making the DER systems ‘secure by design’. If cybersecurity<\/a> is only considered once the system is already on the market, it’s akin to putting a plaster on a life-threatening wound,” Cleveland further explains.<\/p>\n<\/blockquote>\n

The Cyber Resilience Act is coming<\/b><\/span><\/h2>\n

This is precisely where the Cyber Resilience Act (CRA), approved by the European Parliament in spring 2024, comes into play: The regulation will apply to all products that are either directly or indirectly connected to another device or network. This includes connected security cameras, energy management systems, and wind turbine controls. The CRA requires manufacturers to ensure basic cybersecurity<\/a> requirements, such as guaranteeing the confidentiality and integrity of data. It also stipulates that manufacturers must maintain the IT security of their products throughout their lifecycle. They must demonstrate how they address and resolve vulnerabilities in their products. Only with proof of compliance with the CRA can products be brought to the European market with a CE mark in the future.<\/p>\n

Risk Differentiation <\/b><\/span><\/h2>\n

Important and critical products will be categorised into different lists based on their criticality and the degree of cybersecurity<\/a> risk they pose. These lists will be proposed and updated by the European Commission. Products deemed to pose a higher cybersecurity<\/a> risk will undergo stricter scrutiny by a designated body, while others may follow a simpler conformity assessment process, often managed internally by the manufacturers.<\/p>\n

Following the introduction of the CRA – expected later in 2024 – manufacturers will have 36 months to prepare for the upcoming regulations. These will apply to products expected to be introduced to the market from 2027 onwards. <\/span><\/p>\n

\n

Lead MEP Nicola Danti (Renew, IT) stated: “The Cyber Resilience Act will strengthen the cybersecurity<\/a> of connected products, tackling vulnerabilities in hardware and software alike, making the EU a safer and more resilient continent.”<\/span><\/p>\n<\/blockquote>\n

\"Graphic:<\/p>\n

Obligations of Manufacturers under the Cyber Resilience Act<\/b><\/h2>\n