Industrial automation OEM cybersecurity under IEC 62443-4-1/4-2

For OEMs that design and manufacture industrial automation components themselves — PLCs, drives, sensors, HMIs and industrial gateways — rather than assemble a machine from bought parts. IEC 62443-4-1 and 4-2 set secure-development and component requirements, and the EU Cyber Resilience Act adds SBOM and vulnerability duties for the finished component. SoftWSP's Device & Firmware Security service scans your firmware and builds the SBOM these rules call for.

Regulations and standards that apply

• IEC 62443-4-1 — secure development lifecycle. Process requirements for how the OEM builds the product: security requirements, secure design and implementation, verification, defect and patch management, and an end-of-life policy.
• IEC 62443-4-2 — component requirements. Technical security requirements for the component itself, organised under the same foundational requirement areas (identification and authentication, use control, system integrity, and more) as the system-level IEC 62443-3-3 standard.
• EU Cyber Resilience Act — Regulation (EU) 2024/2847. Adds SBOM, vulnerability-handling and Article 14 reporting duties for the component once placed on the EU market as a product with digital elements, on top of — not instead of — the IEC 62443 technical work.
• ISASecure SDLA / CSA certification. Third-party certification routes against IEC 62443-4-1 (SDLA) and IEC 62443-4-2 (CSA), for an OEM that wants an accredited assessment rather than a self-declaration.

Typical device and firmware risks

• Weak or bypassable authentication on the controller's connection or configuration-download mechanism, as found in a real CISA KEV advisory on a Rockwell Logix controller.
• Denial-of-service conditions triggered by malformed network traffic on an EtherNet/IP or similar industrial-protocol module, as found in a real 2026 advisory on a Mitsubishi Electric PLC module.
• Missing authentication on an engineering or SCADA vendor's command API, as found in a real 2026 advisory on an industrial HMI/SCADA platform.
• Outdated open-source libraries (XML parsers, web servers) bundled into the component's firmware and never revisited after release.
• No SBOM or vulnerability-monitoring process covering firmware already shipped in components in the field.

Which SoftWSP service fits

Device & Firmware Security scans your component's firmware, even without source code, builds the SBOM, and maps findings to IEC 62443-4-2's technical requirement areas as an indicative view, with results prioritised by CISA KEV and FIRST EPSS. If you integrate OEM components like these into a complete machine line rather than build the components yourself, see Machine Builders instead — that service covers a Machine SBOM and Vulnerability Report for the assembled line.

Related

• IEC 62443-4-2: component requirements
• CVE-2021-22681: Rockwell Logix controller key bypass
• CVE-2026-8805: Mitsubishi Electric MELSEC iQ-F FX5-EIP denial of service