Starting point & support for the implementation of RED DA and CRA
In recent years, there has been an increasing number of attacks on networked infrastructure worldwide. IoT devices have become a major target in this context. These devices – usually equipped with efficient rather than high-end computing power – require special attention. As an endpoint “on the edge”, IoT devices often provide a direct attack vector for hackers. However, in order to offer the actual added value associated with the IoT, these devices must be connected to an central infrastructure and be able to use server services. This connection is often realized via an app on a standard smartphone as a gateway.
Based on this situation, requirements have been defined in Article 3.3. d, e, f of the RED in order to prevent prominent global events such as the Mirai Bot Net (2016) in the future. These new articles, which must be considered and verified in the products from August 1, 2025. They essentially address
Get your products compliant with EN18031
The process defined in the regulation describes many details that we do not want outline in detail here. But after all, it is about determining the possible risks for the device in the IoT application (e.g. through penetration tests) and developing and implementing defensive measures on this in hardware and software. Once this has been completed, detailed documentation must be created which enables a certification to be achieved.
Our partner CyberWhiz described this in detail in a recent webinar alongside a presentation of how CyberWhiz solutions can help you to complete this process in an optimal, efficient and timely manner.
