Cyber Resilience Act (CRA) Compliance White Paper

As cybersecurity regulations continue to evolve in the European Union, the Cyber Resilience Act (CRA) establishes mandatory requirements for products with digital elements.                   

ICP DAS is committed to aligning with CRA requirements by strengthening product security, secure development processes, and vulnerability management.                   

To support this commitment, we have initiated certification programs including：

• ISO/IEC 27001（Information Security Management System）
• IEC 62443-4-1（Secure Product Development Lifecycle）

Target certification timeline: Completion by end of 2026

This white paper outlines our approach to achieving CRA readiness and ensuring long-term cybersecurity compliance for our partners and customers.

To align with CRA requirements, we focus on the following key domains：

4.1 Secure Development Process

• Adoption of IEC 62443-4-1                       
• Implementation of
  • Secure coding guidelines
  • Threat Modeling
  • Security testing (SAST / DAST)

4.2 Information Security Management

• Establishment ISO/IEC 27001 ISMS
• Coverage:  
  • Risk assessment             
  • Asset management           
  • Access control           
  • Incident response                   

4.3 Vulnerability Management

• Continuous vulnerability monitoring
• PSIRT (Product Security Incident Response Team) setup
• Coordinated vulnerability disclosure process

4.4 Product Security Features                   

  Our products are designed with:

• Authentication and authorization mechanisms
• Secure communication protocols (e.g., TLS)
• Firmware integrity verification
• Secure update mechanisms

By aligning with CRA, our distributors and system integrators benefit from:

• Reduced regulatory risk in EU markets
• Faster project approvals
• Increased customer trust
• Long-term product security assurance

Cybersecurity is an ongoing process.

ICP DAS is committed to：

• Continuous improvement of security processes
• Timely vulnerability patching
• Transparent communication with partners

With proactive investment in ISO 27001 and IEC 62443-4-1，                   

ICP DAS is taking concrete steps toward CRA compliance readiness.

We aim to provide secure, reliable, and future-proof industrial solutions for the European market.

• Nature of Information:
  The timelines and objectives set forth in this white paper are for reference only and do not constitute a legal commitment to “guaranteed certification” or “absolute product security.”
• Schedule Changes:
  The progress of relevant certifications may be affected by the schedules of third-party audit agencies, regulatory changes, or other force majeure events.
• Contract Precedence:
  The specific technical specifications of the product and the terms of the information security support agreement shall be governed by the formally signed purchase contract or product specification document between the parties.