exida launches CRA tool for EU cybersecurity compliance

New tool targets product risk assessments

exida, a company specializing in the cybersecurity of industrial automation and control systems, or IACS environments, announced the release of exSILentia CRA on November 3. The software is integrated directly into the exSILentia platform and is designed for manufacturers preparing to comply with the European Union’s Cyber Resilience Act, or CRA.

According to the company, the tool is intended to speed up assessments, reduce the time needed to achieve compliance and mitigate regulatory risk. The CRA’s application deadline is December 2027. exida said manufacturers of network-connected devices may need to assess anywhere from several dozen to several thousand existing and new products.

TARA is at the center of the compliance process

Under the CRA, manufacturers must demonstrate compliance for every affected product through a product-level process. A central element of this is Threat Analysis & Risk Assessment, or TARA, the product’s cybersecurity risk assessment.

This assessment determines which requirements apply to the product, whether from the selected harmonized standard or from the essential cybersecurity requirements listed in Annex I of the regulation. The process also records how those requirements are implemented and why the selected mitigation measures adequately address the identified risks based on the intended use and operating environment.

According to exida, the risk assessment must be performed for every product within the scope of the regulation, regardless of the product category. The process can require substantial work even for a single product, while the manual workload can increase further for large product portfolios.

Preloaded risk matrix and requirements

exSILentia CRA turns risk analysis into a structured engineering workflow. The software includes a preloaded, industry-standard-based risk matrix, along with predefined mitigation measures and requirements derived from harmonized standards. According to exida, this means product development teams do not have to start every assessment from scratch.

The tool also incorporates the expertise of exida’s cybersecurity certification assessors. The company’s experts regularly conduct assessments related to the ISA/IEC 62443 standard. Iwan van Beurden, exida’s chief technology officer, said product developers should focus on developing products rather than becoming cybersecurity legal experts. exida said the company also uses the software internally to conduct manufacturers’ risk assessments.

exSILentia software package available immediately

exSILentia CRA is immediately available as part of the exSILentia software package. exida provides more information about the tool’s use for CRA-related product compliance at www.exida.com/cra-tool.

The company also emphasizes that using the software alone does not guarantee compliance with the European Union’s Cyber Resilience Act. The tool does not constitute certification or a conformity assessment, and it does not affect the outcome of any separate certification or conformity assessment process. exida is also currently seeking accreditation as an EU CRA notified body.

For manufacturers, the new tool may be useful for organizing the assessment and documentation work associated with the regulation. However, responsibility for compliance and any separate assessment processes remains with the manufacturers.