"3 New Cyber Security Challenges: How Compliance Managers Can Prepare"

Last updated: August 2023

From 1 August 2024*, compliance managers are facing new requirements for CE marking, as cyber security documentation for wireless products will become mandatory.

This is a result of an update to the Radio Equipment Directive (RED), and the newly proposed EU Cyber Resilience Act which further expands this requirement outside wireless products.

* The implementation date has been extended by 12 months, so the new implementation date is 1 August 2025. Read more here.
3 challenges compliance managers are facing

The upcoming requirements are in many ways an advantage for both consumers, manufacturers, and for society at large. Standardised requirements will make the products more secure than today, and provide manufacturers with a defined, acceptable level of security.

But they will also present some challenges for compliance managers, particularly within three areas:

1. Time is of the essence
   The requirements need to be documented for all products put on the market after 1 August 2024 which includes products being produced today (and of course any future products). This actually means that the products need to comply now, as some requirements are virtually impossible to retrofit in an existing product.
   
   
2. The standards are still undefined
   The required standards are expected to be published early 2024 as CENELEC (European Committee for Electrotechnical Standardization) currently are working on the development of European harmonized standards to cover the essential requirements.
   
   
3. New parts of the organisation must be involved
   Compliance managers are used to dealing with traditional safety standards and the respective departments for these in their organisation. But cyber security represents unfamiliar requirements and other parts of the organisation, e.g., software development will need to be included.
   
   

How to deal with these challenges?

We suggest you start considering these upcoming requirements today, and that you start by becoming familiar with relevant standards in order to identify gaps between the standard and your current or upcoming products.

Familiarize yourself with relevant standards

This not only goes for software developers, but for various members across department. As the standards will involve both software developers, technical staff, and more administrative roles, it is important that members across different departments of the company familiarise themselves with the relevant standards.

Depending on products, some of the relevant existing standards may be:

• ETSI/EN 303 645 — This European standard details outcome-focused best practices for the security of Internet-connected consumer devices to provide flexible security measures.
• IEC 62443 — This series of standards focuses on the cyber security of various aspects of industrial communications networks, including industrial automation and control systems and components, as well as requirements for IACS service providers.

1. Gap analysis report: we do a GAP analysis of your product against the standard and provide a list the shortcomings and how you should address these. Such gap analysis may be combined with below trainings and workshops.
2. Training: At Nemko, we have identified the most relevant standards and requirements to meet the regulations. We can take you on a “guided tour” through the standard(s) including examples of solutions.
3. Workshops: we apply each clause of the standard to your specific product. Workshops are a very concrete and useful way to assess incompliance as they are based on one of your existing products.