Complass
Secure development for manufacturers
An email from a security researcher, a gateway in the field and the question of which firmware versions are affected: how manufacturers build a development process that serves the CRA and IEC 62443-4-1 at once.
The Cyber Resilience Act requires not only secure products but also processes with which manufacturers identify, fix and disclose vulnerabilities throughout the support period. IEC 62443-4-1 describes what such a secure development lifecycle looks like.
The whitepaper maps the obligations of CRA Annex I and Art. 13 to the eight practices of IEC 62443-4-1 and shows the way from threat model through SBOM and VEX, vulnerability handling with a PSIRT and coordinated disclosure to security updates and documentation – with a ten-step roadmap and a checklist. Standard texts are not quoted but paraphrased with a clause reference.
Each obligation chapter includes a short "Implementation in Complass" box with a platform screenshot: only features already live are named.
16 pages · Version 1.1 · as of 07.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.