Enable Security in Products: CRA / IEC62443

I specialize in enabling secure, compliant, and resilient industrial products across the entire software lifecycle. With a strong focus on the EU Cyber Resilience Act (CRA), IEC 62443 and modern secure-development practices, I support manufacturers, OEMs, and software suppliers in transforming regulatory requirements into practical, scalable engineering workflows.

My work centers on helping engineering and product teams build security directly into their development and operational processes. This includes creating transparency in complex supply chains, establishing repeatable security controls, and ensuring that organizations can continuously manage risk in fast-moving industrial environments.

Core areas of expertise include:

Extensive experience securing machinery software, embedded systems, industrial connectivity solutions, and IIoT platforms. I help teams design and implement product security concepts that meet both regulatory and customer expectations.

Hands-on guidance to interpret CRA obligations and translate them into structured processes: secure development, vulnerability handling, documentation, conformity assessment, incident reporting and lifecycle security.

Practical implementation of IEC 62443-4-1 and -4-2 requirements in engineering organizations, including security design, secure coding, robustness testing, and supplier management.

Building end-to-end SBOM processes that seamlessly integrate into development pipelines. Selection and integration of tools, normalization of SBOM formats, supplier requests, automated generation, and SBOM-driven risk analysis.

Establishing vulnerability handling processes that meet CRA expectations and industrial requirements. This includes triage workflows, coordinated vulnerability disclosure (CVD), patch strategies, automation, and integration with product roadmaps.

Implementation of CI/CD-integrated controls: static analysis, dependency scanning, threat modeling, secure coding standards, risk assessments, and artifact hardening.

Addressing risks in third-party libraries, firmware components, cloud services, and platform dependencies. Creating transparency and governance for complex industrial ecosystems.

Working closely with development, product management, and compliance teams to build repeatable, efficient processes. I help companies move from “theoretical requirements” to operational security practices that engineers can work with.