Guides
General information on the regulations reshaping device and machine security. Not legal advice — check the current official text for your product.
UN R155, UN R156 and ISO/SAE 21434: automotive cybersecurity and software updates explained
UN Regulation 155 (CSMS), UN Regulation 156 (SUMS) and ISO/SAE 21434: scope, EU mandatory dates, and how the standard and type-approval law fit together.
CISA Secure by Design: the principles and the pledge, explained
CISA Secure by Design: the three core principles, and the seven measurable goals of the voluntary Secure by Design Pledge for software and device makers.
CRA Annex I explained: essential cybersecurity requirements in plain English
A plain-English walk through Cyber Resilience Act Annex I: the product requirements in Part I and the 8 vulnerability handling duties in Part II.
CRA checklist for device makers and embedded firmware teams
A practical Cyber Resilience Act checklist for embedded and firmware teams: what to do before 11 December 2027, and what is already due.
CRA vulnerability reporting: the 24-hour early warning, 72-hour notification and final report
How CRA Article 14 reporting works: 24-hour early warning, 72-hour notification, final report, the ENISA Single Reporting Platform and what to prepare.
CSAF 2.0 and VEX: machine-readable security advisories for device makers
What OASIS CSAF 2.0 and the VEX profile are, how CISA's minimum requirements work, and how device makers can use them to automate PSIRT advisories.
CVSS v4.0 vs v3.1: what actually changed in vulnerability scoring
FIRST CVSS v4.0 explained: Attack Requirements, Vulnerable vs Subsequent System impact, Supplemental metrics, and the CVSS-B/BE/BT/BTE labels vs v3.1.
Cyber Resilience Act requirements: a guide for device and firmware makers
What the EU Cyber Resilience Act requires from device makers: scope, roles, CRA deadlines, Annex I, product classes, fines and first steps.
EN 18031 and the RED delegated act: a guide for firmware teams
EN 18031-1, -2 and -3 under the RED Delegated Regulation 2022/30: which RED article each covers, the restrictions in the OJ, and what firmware must do.
ETSI EN 303 645: the consumer IoT security baseline, explained
ETSI EN 303 645's 13 baseline provisions for consumer IoT devices, its version history, how it relates to UK PSTI, and what it does not formally cover.
FDA premarket cybersecurity for medical devices: Section 524B explained
Section 524B 'cyber device' duties: the SBOM, vulnerability-monitoring plan and patch process a submission needs, and FDA's refuse-to-accept policy.
Firmware SBOM: how to build one when you only have the binary
How to build an SBOM for embedded firmware from binaries, choose CycloneDX or SPDX, use VEX to cut noise, and meet the Cyber Resilience Act SBOM duty.
IEC 62443-4-1: the secure product development lifecycle, explained
What IEC 62443-4-1 requires of a maker's development process: its eight practices, maturity levels, SDLA certification, and how it relates to 4-2.
IEC 62443-4-2 vs the Cyber Resilience Act and EN 18031: what overlaps, what doesn't
Where IEC 62443-4-2's seven component requirements overlap with the CRA's Annex I and EN 18031, and why none of them give presumption of conformity yet.
KEV and EPSS: a practical way to prioritise vulnerabilities in OT and device fleets
How to combine CISA's KEV catalog and FIRST's EPSS score to triage vulnerabilities in OT and device fleets, with CISA's BOD 26-04 deadlines and SSVC.
Machinery Regulation cybersecurity: what 2023/1230 means for machine builders
Cybersecurity in the EU Machinery Regulation 2023/1230: Annex III 1.1.9 and 1.2.1, the 20 January 2027 date, the link with the CRA, and next steps.
NIS2 Directive: what it covers, who it applies to, and how incident reporting works
The EU NIS2 Directive: essential vs important entities, sectors in scope, the transposition deadline, and the 24h/72h/1-month incident reporting timeline.
NIST SSDF (SP 800-218): the four practice groups, explained
NIST's Secure Software Development Framework, SP 800-218: its four practice groups, the link to Executive Order 14028, and the SP 800-218A AI profile.
UK PSTI and the US Cyber Trust Mark: what device makers must do in each market
A side-by-side guide to the UK's mandatory PSTI product security rules and the US voluntary Cyber Trust Mark: scope, requirements, penalties and status.
Vulnerability disclosure policy template and security.txt guide
A free vulnerability disclosure policy template for device makers, plus how to publish security.txt (RFC 9116) with a ready example. Fits CRA and PSTI.