If you work to IEC 62443, you still have a good head start. This guide shows what you can reuse, what only the law requires and how to run both in one process. We describe the standard in our own words only.
Law and standard compared
| Aspect | CRA | IEC 62443 |
|---|---|---|
| Type | EU Regulation (EU) 2024/2847, directly applicable law | International series of standards, voluntary or agreed by contract |
| Subject | Products with digital elements in all sectors | Industrial automation and control systems |
| Addressees | Manufacturers, importers, distributors | Manufacturers, integrators, asset owners |
| Evidence | Conformity assessment, EU declaration of conformity, CE marking | Self-declaration or a certificate from an independent body |
| Security level | Appropriate to the risk, product classes for the procedure | Security levels per component or zone |
| Reporting to authorities | Yes, under Art. 14 | No legal duty |
Which parts matter to whom
- Manufacturers. IEC 62443-4-1 describes the secure development lifecycle, IEC 62443-4-2 the technical capabilities of a component. This is where the overlap with the CRA is greatest.
- Integrators. IEC 62443-2-4 and 3-3 concern services and system requirements. If you build a new product from components and place it on the market, you are its manufacturer under the CRA.
- Asset owners. They work with zones, conduits and security levels. The CRA does not bind them directly, but they benefit from better products and information. NIS2 may apply to them.
The mapping at a glance
This table is our own mapping, not an official one. It uses only the names of the practices in IEC 62443-4-1 and the foundational requirements (FR) in IEC 62443-4-2.
| CRA topic | Matching part of IEC 62443 | What you also check |
|---|---|---|
| Risk assessment (Art. 13(2)) | 4-1: SR, security context and threat model | Record which Annex I Part I requirements apply and how you implement them |
| Secure development (Annex I Part I(1)) | 4-1: SM, SD and SI | Description in the technical documentation |
| Technical product properties (Annex I Part I(2)) | 4-2: FR 1 to 7 | Go through each letter, including data minimisation and secure deletion |
| No known exploitable vulnerabilities (Annex I Part I(2)(a)) | 4-1: SM and SVV | A check before each making available |
| Third-party components (Art. 13(5)) | 4-1: SM | Show due diligence for open source too |
| Security testing (Annex I Part II(3)) | 4-1: SVV | Regularly, also after delivery |
| Vulnerability handling (Annex I Part II(2), (5), (6)) | 4-1: DM | State a contact address and a coordinated disclosure policy |
| Security updates (Annex I Part II(2), (7), (8)) | 4-1: SUM | Free of charge and, where feasible, separate from feature updates |
| User information (Annex II) | 4-1: SG | Add the end date of support and the single point of contact |
What only the CRA requires
These points come from the law. A process under IEC 62443 gives you groundwork for them, but not a finished solution:
- Reporting. Actively exploited vulnerabilities and severe incidents go through the ENISA platform, with an early warning within 24 hours (Art. 14).
- SBOM. You draw up a software bill of materials in a commonly used, machine-readable format (Annex I Part II(1)).
- Support period. You set it, generally at least five years, and state the end date (Art. 13(8), Annex II(7)).
- Conformity. This means conformity assessment, technical documentation under Annex VII, the EU declaration of conformity and CE marking.
- Retention. You keep the documents for at least ten years, or for the support period if that is longer (Art. 13(13)).
What IEC 62443 offers beyond that
The other way round, the standard stays useful for many manufacturers even once the CRA is met:
- Security levels. They give customers a shared language for a component's capabilities.
- Maturity. The development process can be rated per practice.
- Operation and integration. The series connects manufacturer, integrator and asset owner through the same terms.
- The buyers' language. In OT projects, IEC 62443 is a common reference in customer requirements.
Status of the harmonised standards
A presumption of conformity arises only through harmonised standards whose references are published in the Official Journal of the EU (Art. 27(1)). The standards bodies are working on them under the Commission's request M/606.
For the OT area, the standards bodies are working, among other things, on amendments to EN IEC 62443-4-1 and 4-2. Whether and when these lead to references in the Official Journal is open.
As of 5 November 2026, the Commission's page on harmonised standards has no entry for the CRA. Check the status in the Official Journal before each declaration of conformity.
This has a practical consequence for class I products. Self-assessment under module A is only possible there if you fully apply harmonised standards, common specifications or a suitable certification scheme. Otherwise you need modules B and C or module H (Art. 32(2)).
Reusing existing evidence
Without a harmonised standard, you describe your chosen solutions in the technical documentation and list the technical specifications applied (Annex VII(5)). IEC 62443 can go there.
- Record your starting point. Which parts and editions do you apply, for which products, with which certificate or self-declaration?
- Go through Annex I. Map each requirement to the existing practice, component requirement and evidence.
- Name the gaps. Anything without evidence becomes a task, especially the points only the CRA requires.
- Extend the process. Add Art. 14 reporting and informing users to your handling of vulnerabilities.
- Transfer to the documentation. Describe the solutions per requirement in the technical documentation.
- Watch the standards. Once references are published, check whether you switch over.
Example from industry
This example is invented. A maker of operator panels has worked to IEC 62443-4-1 for years and declares SL-C 2 for its panel. A mapping shows three groups:
- Ready to use. The threat model, test reports and the process for security updates go into the technical documentation.
- To be added. The bill of materials exists as a spreadsheet and is now generated in the build. The end date of support will appear in the user information.
- New. A reporting person and a deputy are named, and the early warning is rehearsed once.
If the company also builds machines, the Machinery Regulation comes on top. It applies from 20 January 2027 and has its own requirements on protection against corruption and on the safety of control systems (Annex III sections 1.1.9 and 1.2.1).
Typical mistakes
- Certificate equals conformity. A certificate under IEC 62443 replaces neither the conformity assessment nor the CE marking.
- Two separate projects. If you run the CRA and IEC 62443 separately, you provide the same evidence twice.
- Looking only at the technology. The CRA also requires processes for the time after delivery.
- Adopting old editions unchecked. Record which edition of the standard you apply.
The CRA and IEC 62443 in Complass
An Excel mapping goes stale with the next product version. In Complass, you run both frameworks together:
- IEC 62443 module for manufacturers. Nine phases lead through 4-1 and 4-2, with all 47 practice requirements and the component requirements per SL-C.
- Link to the CRA. The module names the link to the CRA and the Machinery Regulation for the requirements.
- Mapping template. A template maps CRA Annex I to the implemented practices and component requirements and serves as a basis for the technical documentation.
- Framework overview. Each row is a cross-framework control, each column a project. You see which implementation covers several frameworks at once.
- Product file per version. The CRA and the Machinery Regulation sit in one file with requirements, SBOM, vulnerabilities and support period.
The texts of the standards are not included, because standards are protected by copyright. Complass explains the requirements in its own words. You can store excerpts from your licensed edition yourself.
Checklist
- The parts and editions of IEC 62443 you apply are recorded.
- Annex I Parts I and II are mapped to practices and component requirements.
- Gaps are captured as tasks with owners.
- Vulnerability handling includes Art. 14 reporting.
- The SBOM is produced per version in a machine-readable format.
- The support period is set for each product.
- The product class and the procedure are determined.
- The technical documentation names IEC 62443 as an applied specification.
- Someone watches the status of the harmonised standards.
Frequently asked questions
Does an IEC 62443 certificate replace the conformity assessment?
No. As long as no reference is published in the Official Journal, IEC 62443 gives no presumption of conformity. The certificate is, however, a strong building block for your technical documentation.
Do we have to apply IEC 62443 to meet the CRA?
No. The CRA does not prescribe a specific standard. You can meet the requirements in other ways and then describe your solutions in the technical documentation (Annex VII(5)).
We are an asset owner. Does this mapping concern us?
Usually not directly, because the CRA binds manufacturers, importers and distributors. If you substantially modify a product and make it available on the market, that changes (Art. 22). For your own operations, you use the parts for asset owners and, where applicable, NIS2.
Is IEC 62443 still worthwhile if harmonised standards are coming anyway?
For OT products, the standardisation work under request M/606 builds on parts of IEC 62443. A process under IEC 62443-4-1 therefore remains a sensible basis. What the final standards will look like is not yet settled.
In a demo, we show you how to record existing evidence once and use it for both frameworks.
Request a demo Try it for 14 days
Read more
- Whitepaper "Secure development for manufacturers"
- Whitepaper "IEC 62443 for asset owners, integrators and manufacturers"
- IEC 62443 for manufacturers in Complass
- Cyber Resilience Act in Complass: from applicability to CE marking
- Machinery Regulation in Complass
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The wording of your licensed edition of the standard is decisive. Status of standardisation: 5 November 2026.