---
title: "CRA Preparation FAQ's"
slug: "preparing-for-the-cra-faqs-for-machinebuilders"
updated: 2026-10-20T11:25:32Z
published: 2026-10-20T11:25:32Z
canonical: "kb.secomea.com/preparing-for-the-cra-faqs-for-machinebuilders"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.secomea.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CRA Preparation FAQ's

## Preparing for the CRA: FAQs for Machine Builders

This FAQ is intended to provide general information and practical guidance based on Secomea's current understanding of the Cyber Resilience Act and available European Commission guidance. It does not constitute legal or regulatory advice, and the applicability of CRA requirements will depend on the specific product, its intended purpose and how it is placed on the market. Machine builders remain responsible for assessing and demonstrating the compliance of their own products. The CRA implementation framework, harmonised standards and supporting guidance continue to develop. Secomea will therefore update this FAQ where relevant as further guidance and standards become available.

#### 1.What is CRA and who does it apply to?

The Cyber Resilience Act is an EU regulation that sets cybersecurity requirements for all products with digital elements placed on the EU market. It applies to manufacturers, including device makers and machine builders, and requires them to ensure security throughout the product lifecycle.

#### 2.When does CRA apply and what is the timeline?

The Cyber Resilience Act entered into force on 10 December 2024. The Article 14 reporting obligations have applied since 11 September 2026, requiring manufacturers to report actively exploited vulnerabilities and severe security incidents affecting their products. Most other CRA requirements, including product cybersecurity, conformity assessment and CE marking, will apply from 11 December 2027. Manufacturers must therefore already now comply with the reporting obligations while preparing for full CRA compliance.

#### 3.What is a “product with digital elements”?

A product with digital elements is any hardware or software that can process, store, or transmit data and has a direct or indirect connection to a network or device. This includes industrial machines, controllers, and remote access solutions.

#### 4.Does using Secomea change my machine’s CRA classification?

No, the CRA classification of a product is determined by its core functionality and intended purpose, not by the individual components integrated into it. A remote access solution such as Secomea may influence how security is implemented, but it does not redefine the product’s classification.

#### 5.Do VPN-based solutions create more CRA burden than non-VPN tools?

No, the CRA does not differentiate between VPN and non-VPN technologies. The regulation focuses on how cybersecurity risks are managed, including authentication, access control, and system exposure, rather than on specific technical labels.

#### 6.Is Secomea responsible for my machine’s CRA compliance?

No. Secomea is responsible for ensuring that its own products meet the applicable CRA requirements. As the machine builder, you remain responsible for the CRA compliance of the complete machine you place on the market, including how Secomea and other components are integrated and used.

#### 7.How does Secomea help me meet CRA requirements?

Secomea helps machine builders meet CRA requirements by providing secure remote access and controlled connectivity, supporting key cybersecurity requirements such as access control, secure communication and reduced exposure. Secomea also supports lifecycle security by enabling secure firmware updates and providing visibility into vulnerabilities through Secomea PRIME.

#### 8.Is CRA compliance required for CE marking?

Yes, CRA requirements are integrated into the CE marking process, meaning that cybersecurity compliance is a condition for placing products on the EU market. Without meeting CRA requirements, a product cannot legally carry the CE mark and be sold in the EU.

#### 9.What happens if a machine builder does not comply with CRA?

Non-compliance can result in the product being blocked from the EU market, as well as significant financial penalties, including fines based on company turnover.

#### 10.Does CRA apply to all machine components?

Yes, your CRA assessment needs to consider the cybersecurity of the complete product, including integrated third party components such as PLCs, HMIs and remote access solutions. You must exercise appropriate due diligence to ensure these components do not compromise the cybersecurity of your machine.

#### 11.If I need to replace a component during the machine’s support period, do I have to provide the replacement free of charge?

Not necessarily. Security updates during the declared support period must generally be provided free of charge, but the CRA does not contain a general requirement to provide replacement hardware free of charge. However, the machine builder remains responsible for addressing cybersecurity risks during the machine’s support period and cannot avoid its vulnerability handling obligations simply by requiring the customer to purchase a replacement component.

#### 12.What happens under CRA if I replace a PLC or another component in an existing machine?

Replacing a component does not automatically make the machine a new product under CRA. If an identical spare part manufactured to the same specifications is used, the CRA provides a specific exemption for that spare part. If a different or newer component is used, the replacement component may itself be subject to CRA, and the machine builder should assess whether the change affects the machine’s intended purpose, cybersecurity risk profile or compliance. If it does, the change could potentially constitute a substantial modification.

#### 13.Do machine builders need to perform a cybersecurity risk assessment?

Yes, machine builders must perform a cybersecurity risk assessment for their products. This assessment is used to identify risks, determine which security measures are required, and justify all design and security decisions.

#### 14.Do machine builders need to assess third-party components (PLC, HMI, SRA, etc.)?

Yes, manufacturers must perform due diligence when integrating third-party components to ensure they do not introduce unacceptable cybersecurity risks.

#### 15.Is remote access required to comply with CRA?

Secure remote access is not explicitly required by CRA. However, for machine builders with machines deployed at customer sites, it can be difficult to meet lifecycle obligations without it. Secure remote access supports vulnerability management by providing visibility into affected machines and firmware versions and enabling security updates to be planned and deployed remotely.

#### 16.What information should I request from suppliers as part of CRA due diligence?

Machine builders should collect sufficient information to assess whether third party components can be securely integrated and supported throughout the machine lifecycle. This may include the supplier's support period, vulnerability disclosure process, security contacts, update policy, supported software or firmware versions, security advisories and relevant compliance documentation.

#### 17.Do I need an SBOM for my machine?

The CRA requires manufacturers to identify and document the components contained in their products, including through a Software Bill of Materials covering at least the top level dependencies. An SBOM therefore becomes an important part of understanding which software components are present and determining whether newly discovered vulnerabilities affect the machine. CRA does not require the SBOM to be shared externally.

#### 18.What information should I include for the Secomea component in my SBOM?

Machine builders should identify the SiteManager as an integrated third party component, including Secomea A/S as the manufacturer, the SiteManager model, and the installed firmware version. Secomea does not share its internal product SBOM externally, but provides firmware and vulnerability information that enables machine builders to identify affected SiteManager versions and manage related vulnerabilities throughout the machine lifecycle.

#### 19.What is considered a “substantial modification” under CRA?

A substantial modification is any change that affects the product’s intended purpose or introduces new cybersecurity risks. When this happens, the product may be treated as a new product and must undergo a new compliance assessment.

#### 20.Do software updates trigger new CRA obligations?

Not all updates do, but updates that introduce new functionality or risks may be considered substantial modifications and require reassessment.

#### 21.What does “secure by default” mean under CRA?

Secure by default means that products must be delivered with security features enabled and configured to minimize risk without requiring user action. This includes disabling unnecessary functions and reducing the attack surface.

#### 22.Do machine builders need to publish vulnerabilities?

Machine builders are not necessarily required to publish all vulnerabilities publicly, but they must have processes in place to receive, assess, and handle vulnerabilities. They must also report actively exploited vulnerabilities and serious incidents to authorities, which increases the level of accountability and traceability.

#### 23.Do I need a way for customers and security researchers to report vulnerabilities to me?

Yes. Machine builders need a coordinated vulnerability disclosure process and a clear point of contact through which vulnerabilities can be reported. This enables vulnerabilities to be assessed, addressed and communicated throughout the machine's support period.

#### 24.Do I need to know which machines and components are affected by a vulnerability?

Yes. Machine builders should be able to identify the affected machine models, components, and software or firmware versions. Where exposure depends on configuration, relevant security configurations should also be identifiable. This does not require continuous tracking of every customer setting, but records and guidance must be sufficient to identify affected machines and communicate the necessary remediation.

#### 25.How should I inform customers about vulnerabilities and security updates?

Machine builders need a process for communicating relevant vulnerabilities, available security updates and any actions customers need to take. This could include security advisories, customer portals, email notifications or other appropriate channels, depending on the product and customer relationship.

#### 26.Does CRA require automated vulnerability management?

CRA requires effective vulnerability management processes, but it does not mandate full automation. In industrial environments, updates often require validation, testing, and coordination, so automation must be balanced with operational safety and system integrity.

#### 27.Can vulnerabilities be handled without immediate action (e.g. patching)?

Yes, CRA allows a risk-based approach. In many cases, vulnerabilities can be mitigated or monitored rather than immediately patched, especially in OT environments where stability and safety are critical considerations.

#### 28.Does the Vulnerability Hub allow mitigation actions directly?

Currently, the Vulnerability Hub primarily provides visibility into device status, such as outdated firmware or end-of-life conditions. It does not directly execute mitigation actions, but it enables informed decision-making, which is a key part of CRA compliance.

#### 29.Can firmware updates be performed centrally?

Yes. Secomea’s secure remote access can be used to connect to machine components such as PLCs or HMIs and perform their vendor specific firmware updates remotely. Secomea devices themselves can also be updated remotely so they remain protected against known vulnerabilities.

#### 30.Is fully automated firmware updating possible today?

Fully automated updates to the latest firmware are generally not implemented as a default, mainly because machine builders and operators need to validate compatibility and system behavior before applying updates.

#### 31.Why is automatic updating not always desirable?

In industrial systems, firmware updates can affect system behavior and require testing, validation (e.g. FAT), and coordination with other components. Automatic updates without validation could introduce operational risks.

#### 32.Would automatic updates to “latest firmware” be useful?

From a technical perspective, automatic updates could simplify vulnerability handling. However, many machine builders are not yet ready for this approach due to the need for controlled validation and system-level testing.

#### 33.Can updates be triggered centrally?

Yes, it is possible to trigger updates to a specific firmware version across devices, but this requires manual selection and management of the target version rather than automatic tracking of “latest available.”

#### 34.Will CRA increase workload for machine builders?

Yes, CRA introduces additional obligations for vulnerability handling, documentation, and lifecycle support, which will require more time, resources, and structured processes. CRA requires technical documentation that demonstrates how risks are identified and mitigated. This documentation must be maintained and made available to authorities if requested.

#### 35.What is the required support period under CRA?

Machine builders must provide security support for a minimum of five years. The support period must reflect how long the machine is reasonably expected to be in use and must generally be at least five years. For industrial machinery with a longer expected lifetime, the support period may therefore need to be significantly longer than five years.

#### 36.What is the support period for Secomea products?

Secomea provides a minimum five year security support period for its products. This reflects the rapidly evolving threat landscape for cybersecurity products and enables Secomea to provide effective vulnerability handling and security updates based on technologies, components and security mechanisms that can be supported throughout that period.

#### 37.Do I need to know the support periods of the components inside my machine?

Yes. The support periods of third party components providing core functions are one of the factors a machine builder may consider when determining the support period of the complete machine. If a component reaches end of support before the machine does, the machine builder remains responsible for managing vulnerabilities in the complete product and may need another way to mitigate the risk.

#### 38.What happens if a component reaches end of support while my machine is still within its support period?

The machine builder's responsibility does not end simply because a component supplier stops supporting a component. If a vulnerability affects the machine during its support period, the machine builder must still address the risk, for example through mitigation, replacement of the component or another appropriate technical measure.

#### 39.Do machine builder need Service Level Agreements (SLAs)?

Implementing SLAs becomes increasingly important, as ongoing support, updates, and vulnerability handling will require defined responsibilities, timelines, and resource planning.

#### 40.Why is lifecycle security becoming critical?

CRA shifts the focus from delivering a product to maintaining it securely over time. This includes monitoring vulnerabilities, applying updates, and ensuring continued compliance throughout the product’s lifecycle. If you have questions about Secomea's CRA readiness, the integration of Secomea into your machines, or how our capabilities can contribute to vulnerability management and lifecycle security, please contact your Secomea representative or Secomea Partner.

We also welcome questions that are not yet covered in this FAQ. They help us understand where machine builders need further clarification and will inform the additional CRA enablement materials we are developing.