SecureOT TM cybersecurity capabilities

Cybersecurity is rapidly becoming a core requirement for doing business, selling products and meeting regulatory obligations for Original Equipment Manufacturers (OEMs). New regulations, including the Cyber Resilience Act (CRA) and Machinery Regulation (MR), are introducing stricter requirements around secure product development, vulnerability management, software maintenance, incident reporting and cybersecurity throughout the equipment lifecycle.

What Do These Regulations Mean for OEMs?

Meeting these requirements mandates shared accountability across the industrial ecosystem including manufacturers, machine builders, software providers and end users. For OEMs, compliance is no longer just protecting your own business systems. It's increasingly showing customers, regulators and partners that your machines, software and connected products are built and supported with cybersecurity in mind.

The CRA establishes mandatory, lifecycle-wide cybersecurity regulations for all manufacturers, importers and distributors offering Products with Digital Elements (PDEs) containing connected hardware, software, embedded components and remote data processing solutions. OEMs must implement secure-by-design practices, ship systems free from risk or vulnerabilities, and maintain processes for reporting evolving cybersecurity risk. Emerging CRA regulations apply to OEMs whether they are building within or shipping to the EU. Reporting requirements for the CRA will begin in September 2026, with full compliance required by December 2027.

The new Machinery Regulation integrates cybersecurity into machinery safety and conformity requirements, expanding expectations for machine builders and equipment manufacturers. The regulation emphasizes that cybersecurity must be considered throughout machine planning, design, development, production, delivery and maintenance phase , thereby helping ensure that machinery remains safe and resilient in increasingly connected industrial environments. Full compliance with the Machinery Regulation will be required in January 2027.

SecureOT Offers OEMs A Compliance-Ready Cybersecurity Program

SecureOT™ offerings specifically for OEMs help strengthen cybersecurity readiness, integrate secure-by-design practices, support compliance readiness and continuously monitor machine cybersecurity risk.

Key differentiators of SecureOT capabilities for OEMs

Gain visibility into cybersecurity risks, vulnerabilities and compliance gaps across products, systems and operations. SecureOT assessment services provide a system-specific roadmap to address deficiencies and accelerate secure by design delivery.

Capabilities include:

Cybersecurity maturity assessments

Machine-level risk and vulnerability assessments

Architecture and security reviews

Compliance readiness evaluations

OT asset discovery and inventory

Strengthen cybersecurity posture, reduce audit burden and align with evolving regulatory expectations with strategic guidance and hands-on execution from cybersecurity experts who understand industrial environments and OEM operations.

Capabilities include:

CRA and MR regulatory and compliance readiness

Cybersecurity strategy and program development

Establish policies and procedures to support audits and ongoing regulatory obligations

As cybersecurity regulations continue to evolve, OEMs need a more efficient way to manage machine cybersecurity information throughout the product lifecycle.

Specifically built for OT environments, SecureOT™ Platform gives OEMs a more structured and scalable approach to cybersecurity, helping simplify documentation, support compliance readiness and continuously identify and document cyber risks across deployed assets.

System summaries and machine hardware and software inventory reporting

Vulnerability and patch tracking

Ongoing risk monitoring

Compliance-ready reporting and recordkeeping

Build a complete cybersecurity System Summary including:

Software inventory aligned to CRA requirements

Hardware inventory, firmware versions, and component details

Known vulnerabilities, exposures, and associated risk status

Documentation demonstrating cybersecurity due diligence and secure-by-design practices

Maintain security throughout the machine lifecycle:

Monitor newly disclosed vulnerabilities and product advisories

Assess impact across deployed machines

Track security updates

Support customer reporting and regulatory obligations

Business Outcomes OEMs Can Achieve with SecureOT

SecureOT for OEMs helps machine builders streamline CRA readiness with machine-level visibility, prioritized remediation and compliance reporting to support secure-by-design products and achieve these business outcomes:

Minimize engineering effort and compliance burdens while simplifying regulatory documentation.

Increase risk visibility , enable informed decisions and uncover security gaps.

Build customer trust , strengthen differentiation and boost confidence in machine security.

Accelerate compliance readiness , prioritize risks and scale cybersecurity improvements.

Reduce machine and operational vulnerability , improve resilience and support business growth .

Rockwell's SecureOT™ Portfolio Offerings

CRA & Machinery Regulation Overview

MACHINE BUILDER OBLIGATION

Documentation and Compliance

Machine Builder Obligation

Vendors shall provide risk assessment documentation describing how cybersecurity risks were considered and mitigated during development, including technical documentation, cybersecurity measures, and SBOMs.

Rockwell’s SecureOT portfolio provides a range of software and services that range from assessing secure development/design principles, assessing machine build standards as well as scanning and documentation of as-built equipment over time.

Machine Builder Obligation

Products must be made available on the market with a secure by default configuration, unless otherwise agreed between manufacturer and business user.

Rockwell’s core product line provides certified secure products (to 4-1 maturity level 4, 4-2 product certification) for use in designing machine components. Coupled with our security consulting , we can help assess the security of the entire machine from hardware to communications and on.

Machine Builder Obligation

Protect the confidentiality and integrity of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state‑of‑the‑art mechanisms.

CIP Security protects data in transit and increased device security capabilities such as encryption of data-in-rest within the controller protects the customer’s IP. This is a core feature of Rockwell products and is a key component of our services and software checks for during design and system summary stages.

Machine Builder Obligation

CIP Security protects data in transit and increased device security capabilities such as encryption of data-in-rest within the controller protects the customer’s IP. This is a core feature of Rockwell products and is a key component of our services and software checks for during design and system summary stages.

Expanding footprint of products supporting CIP Security or other Secure Communications will enable products from software to device layer to communicate securely with integrity and authenticity.

Vulnerability Management and Updates

Machine Builder Obligation

Ensure protection from unauthorized access through appropriate control mechanisms, while implementing processes to identify, assess, remediate, and patch vulnerabilities throughout the lifecycle.

Device Security and System Hardening can be used together with change detection, configuration compliance and contextualized Risk visibility within SecureOT™ Platform .

Machine Builder Obligation

Provide security‑related information by recording and monitoring relevant internal activity, including the access to or modification of data, services or functions, with an opt‑out mechanism for the user.

SecureOT Platform can provide centralised log ingestion and analysis. More devices will support the use of Syslog to provide the foundation to track both intended and unintended events.

Vulnerability Reporting

Machine Builder Obligation

Reporting obligations for exploited vulnerabilities and security incidents, i.e. 24 hour initial reporting windows.

Enhanced transparency is an important aspect of the regulations. SecureOT Platform can provide Vulnerability Mapping and remediation capability.

Moving forward, CRA sets the requirement for OEMs to demonstrate that connected machines, control systems and digital products are designed and supported with industrial cybersecurity built in. By proactively investing in cybersecurity capabilities, processes and documentation, OEMs can differentiate their offerings, build stronger customer relationships and capitalize on growing demand for secure, connected products to meet customer demands and maintain trusted relationships.

Why OEMs Partner With Rockwell Automation for Cybersecurity

OEMs require cybersecurity partners who understand both industrial operations and the realities of machine building. SecureOT™ offerings from Rockwell Automation combine industrial cybersecurity expertise, advisory services and SecureOT™ Platform to help OEMs confidently navigate today's regulatory environment while preparing for tomorrow's requirements.

Decades of experience helping manufacturers, machine builders and industrial organizations secure critical operations.

From assessments and advisory services through implementation and ongoing monitoring, Rockwell Automation helps develop comprehensive cybersecurity programs for long-term effectiveness.

Built on decades of cybersecurity expertise but grounded in over 100 years of industrial automation and manufacturing development, we help clients provide IT type protection in complex OT environments.

Establish cybersecurity as a built-in part of machine design, deployment and lifecycle management. SecureOT™ Platform delivers the visibility and context needed to reduce risk, achieve compliance obligations and maintain operational integrity without interrupting production.

Scalable Programmatic Security

A measurable, repeatable approach that enables OEMs to systematically build and scale cybersecurity capabilities while supporting business growth and regulatory compliance.

Support for helping organizations address requirements associated with industry standards and emerging regulations, including IEC 62443, CRA and the Machinery Regulation.

Building On An Established Security Infrastructure

Rockwell Automation helps OEMs address evolving cybersecurity and compliance requirements by building on a foundation of certified practices and embedded security capabilities.

1. IEC 62443 Certified Foundation

Building cybersecurity into products, development processes and industrial solutions.

IEC 62443-4-1 - Secure Development Lifecycle certified at Maturity Level 4

IEC 62443-4-2 - Product certification by third-party TUV Rheinland

IEC 62443-3-3 - Industry system solution

IEC 62443-2-4 - Certified Industrial Security Services

IEC 62443-2-4 – Industry's first plant-wide IEC 62443 certification

Product communications and device trust.

Authentication – helps prevent unauthorized device from establishing connections

Integrity – helps prevent tampering or modification of communications

Confidentiality – helps prevents snooping or disclosure of data

3. FactoryTalk Policy Manager (FTPM)

Centralized security administration and policy management.

System management – easily create and deploy security policies

Micro-segmentation – segment your automation application into smaller zones

Device-based firewall – restrict backplane access and bridging via the security policy

4. Access Control & Logging

Control user privileges and strengthen communications.

Role-based access control – extension of CIP Security providing user-defined privileges

CIP Security – expand portfolio adoption of the CIP Security Technology

Logging – continue to expand the Syslog infrastructure

5. CRA & Machinery Regulation Readiness

Security capabilities designed to support emerging OEM requirements.

Secure by default – products have Secure Boot, signed FW, RBAC (when available), along with CIP security technology

Encrypted data storage – store application code securely on controllers

Secure system time – securing PTP to ensure system coordination

Take the Step Toward Cyber Resilience

SecureOT combines OT‑specific designed software, expert services, and global scale to reduce risk, improve uptime, and simplify compliance for industrial operations.

OS Hardening Compatibility

US Executive Order – NIST 800-218

Secure Software Development Framework

A list of important details the machine that must be shipped with the machine, including software components, hardware specifics and an attestation/report that the current configuration is free of any known vulnerabilities and has no needs related to patching.

SecureOT Platform gathers detailed, asset-related security information while also enabling remediation, allowing OEMs to move beyond simply identifying risks to actively managing and taking informed action that closes gaps and strengthens defenses. To support with NIS2 requirements, Rockwell Automation offers a wide range of services:

Strategic Advisory, providing compliance and readiness assessments to understand current steps and actions to achieve compliance

Specific OT Cybersecurity Policy and Procedures, Risk Assessments and Cybersecurity Training that help mitigate compliance gaps

Products and software that meet requirements around encryption, such as CIP Security, FT Policy Manager & FT Security

The current version of the CRA states that an SBOM is met by having a listing of all firmware, software, versions, vulnerabilities and assets of the machines. This is delivered to our SOTP users with current ‘off the shelf’ capabilities. The more commonly known term SBOM in the marketplace is actually meaning the list of software AND all of the libraries, binaries, and dependencies WITHIN the software. This is not a current requirement of CRA but is being monitored by RA should we need to adjust our offering for future regulatory requirements.

No, Rockwell provides data, reports and visibility, but is not a formal CRA or machine regulation auditing authority.

No. The license will remain with the OEM.

Partner with our experts to define a roadmap aligned to your manufacturing operations, risk priorities, and budget goals.

Based on your activity