GlobalPlatform is calling on manufacturers of connected devices and components to adopt its ‘Security Evaluation Standard for IoT Platforms’ methodology to demonstrate conformance with the Cyber Resilience Act (CRA), which aims to strengthen cybersecurity across the EU by outlining a new, legal framework for products with a digital element.
The CRA was published in the Official Journal of the European Union last month and entered into law on 11th December. Manufacturers will 36 months to comply with the legislation, and will eventually require all relevant products to comply in order to obtain the CE marking.
SESIP is a key part to meeting the requirements mandated by the CRA, as it provides manufacturers with a proven methodology for conducting security evaluations of software and hardware components across their products and supply chains. SESIP is recognised as a standard by CENELEC, the European Standardization Organization, as EN 17927. It also aligns with many other legislation and vertical certification schemes around the world, including the Cyber Trust Mark in the US.
The methodology is being used to certify components, platforms, and modules from a range of companies and is supported by a growing ecosystem of security providers, certification bodies (CBs), security laboratories, and other stakeholders. GlobalPlatform is continuing to support the growth and governance of the SESIP ecosystem. SGS Brightsight has recently been accredited as a SESIP CB following approval from the Spanish national accreditation body (ENAC), becoming the second SESIP CB after TrustCB.
“Industry support for SESIP is building at this critical juncture for IoT manufacturers operating in Europe,” said Gil Bernabeu, CTO of GlobalPlatform. “The Cyber Resilience Act is vital to protecting consumers and businesses by embedding security features into the heart of the connected devices we use every day, providing a cybersecurity framework that spans the design, development, and maintenance of digital products.
“However, this landmark legislation presents a range of compliance challenges for manufacturers of connected devices and the components used in these products. SESIP simplifies conformity with the new regulations by providing a unified framework for comprehensive security evaluation, reducing cost, risk, and time to market. We look forward to expanding the SESIP ecosystem to help multiple industry sectors meet the requirements of the new European regulations. It will also enable international manufacturers to reuse their security evaluation investments to demonstrate conformance to non-European regulations.”
The SESIP methodology is already mapped to other standards and regulations such as ETSI, (EN 303645 / TS 103732), ISO/IEC (62443-4-2), RED (EN 18031), UNECE WP.29 (ISO/SAE 21434) and NIST (NIST 8259 / NIST 8425). It is also being used by schemes such as PSA Certified, and standardisation bodies including the Car Connectivity Consortium and the Wireless Power Consortium. In addition to Europe, SESIP is being adopted around the world in key markets such as China, where an agreement was recently reached between GlobalPlatform and China’s National Financial Technology Certification Center (NFTC).
There’s plenty of other editorial on our sister site, Electronic Specifier! Or you can always join in the conversation by commenting below or visiting our LinkedIn page.
