Cyber Resilience Act

The Cyber Resilience Act fundamentally changes the cybersecurity requirements for products with digital elements in Europe.

At its core is the idea that security does not only become relevant once a vulnerability has been discovered. Cybersecurity should already be considered during conception and development and then maintained over a product's intended support period.

For manufacturers, this means, among other things, assessing and documenting cybersecurity risks, taking fundamental security requirements into account during development and deployment, and establishing processes for handling vulnerabilities.

Security thus becomes a task across the entire product lifecycle.

Our software solutions support and control processes within intralogistics. Reliability, availability and responsible handling of security risks are therefore of high importance to us.

The CRA gives this commitment a binding European framework.

We are therefore intensively addressing the resulting requirements and continuously developing our processes and structures accordingly. In doing so, we view cybersecurity not as a one-off project but as an ongoing task.

Cybersecurity risks should already be considered during conception and development. The CRA requires manufacturers to assess cybersecurity risks and take them into account during planning, development, deployment and maintenance, among other things.

For us, this means: security is not added afterwards but is treated as part of the software lifecycle.

Even after software is deployed, new vulnerabilities may become known. That is why structured handling of security information is becoming increasingly important.

The CRA provides that manufacturers effectively handle vulnerabilities in their products and the components they contain during the defined support period. In addition, appropriate processes must be in place for potential vulnerabilities reported internally or externally.

For IFD, this means: detect, assess, remediate and respond appropriately.

Security works best when potential problems reach the right contacts at an early stage.

That is why we are creating a central and direct channel for reports of potential security issues and vulnerabilities with our IFD Security Hub.

This allows such reports to be captured in a structured way and processed within our security processes.

A key idea of the CRA is the manufacturer's responsibility even after a digital product has been placed on the market.

Manufacturers must define a support period and effectively handle vulnerabilities during this period. As a rule, this period is at least five years; if a product is expected to be used for less than five years, the period may correspondingly be based on this shorter period of use. For products with a longer expected service life, a longer period may accordingly be relevant.

This lifecycle approach is particularly important for software solutions in an industrial environment: systems and solutions can be used there over long periods of time. That is exactly why, at IFD, we regard security as a continuous responsibility rather than a snapshot.

The CRA also strengthens the requirements for dealing with security issues that have become known.

As of 11 September 2026, the CRA reporting obligations apply to actively exploited vulnerabilities and severe incidents. In such cases, manufacturers must submit an early warning notification without undue delay and in any event within 24 hours and, unless the relevant information has already been provided, a vulnerability notification or incident notification within 72 hours via the single reporting platform. A final report is required no later than 14 days after a corrective or mitigating measure is available for actively exploited vulnerabilities. For severe incidents, it must be submitted within one month after the incident notification.

For such processes to work, it is crucial that potential vulnerabilities are actually detected and communicated.

This is exactly where our Security Hub comes in. Customers, partners and security researchers receive a clear path to draw our attention to potential security issues.

Have you discovered a potential vulnerability in an IFD solution?

The Cyber Resilience Act raises the cybersecurity requirements for digital products. For us, it is also an important impetus to review and further develop existing processes and to consider security even more strongly across the entire lifecycle of our solutions.

Our commitment is clear:

• Detect risks early.
• Handle vulnerabilities responsibly.
• Continuously improve security processes.
• Build trust through transparency.

Because modern intralogistics needs not only high-performance software.

It needs software you can rely on.