SESIP enables IoT manufacturers to conform to CRA rules
Manufacturers of connected devices and components that adopt the “Security Evaluation Standard for IoT Platforms” (SESIP) methodology from GlobalPlatform will be able to demonstrate conformance with the European Union’s new Cyber Resilience Act (CRA), which comes into force this month.
The enactment of the CRA puts into place mandatory cybersecurity rules that span the entire lifecycle of a digital product sold in the EU. The CRA was published in the Official Journal of the European Union last month and became law on December 11, 2024. However, product manufacturers will have 36 months to fully comply with the legislation, but will eventually have to comply with the rules in order to obtain the CE marking, a mandatory market requirement for issuing products in Europe.
As an internationally recognized standard for IoT security evaluation, SESIP is key to meeting the requirements mandated by the CRA. It provides manufacturers with a proven methodology for conducting security evaluations of software and hardware components across their products and supply chains. SESIP is recognized as a standard by CENELEC, the European Standardization Organization, as EN 17927. It also aligns with many other legislation and vertical certification schemes around the world, including the Cyber Trust Mark in the US.
The methodology is being used to certify components, platforms, and modules from a range of companies and is supported by a growing ecosystem of security providers, certification bodies, security laboratories, and other stakeholders.
“Industry support for SESIP is building at this critical juncture for IoT manufacturers operating in Europe,” said Gil Bernabeu, CTO of GlobalPlatform. “The CRA is vital to protecting consumers and businesses by embedding security features into the heart of the connected devices we use every day, providing a cybersecurity framework that spans the design, development, and maintenance of digital products.”
“However, this landmark legislation presents a range of compliance challenges for manufacturers of connected devices and the components used in these products,” continued Bernabeu. “SESIP simplifies conformity with the new regulations by providing a unified framework for comprehensive security evaluation, reducing cost, risk, and time to market. We look forward to expanding the SESIP ecosystem to help multiple industry sectors meet the requirements of the new European regulations. It will also enable international manufacturers to reuse their security evaluation investments to demonstrate conformance to non-European regulations.”
The SESIP methodology is already mapped to other standards and regulations such as ETSI, (EN 303645 / TS 103732), ISO/IEC (62443-4-2), RED (EN 18031), UNECE WP.29 (ISO/SAE 21434) and NIST (NIST 8259 / NIST 8425). It is also being used by schemes such as PSA Certified, and standardization bodies including the Car Connectivity Consortium and the Wireless Power Consortium. In addition to Europe, SESIP is being adopted around the world in key markets such as China, where an agreement was recently reached between GlobalPlatform and China’s National Financial Technology Certification Center (NFTC).
GlobalPlatform has a number of initiatives in place to help accelerate SESIP adoption for the new CRA, including the launch of a training program and the SESIP Adopters community to give non-members the ability to keep up to date with relevant technical documents and showcase certified SESIP products.
https://globalplatform.org/sesip
If you enjoyed this article, you will like the following ones: don't miss them by subscribing to :
