Cyber Resilience Act: plan machine access, updates and support.

Control who reaches each application, know which version is installed and give security corrections a route to the customer. Orenda supports the access and local application architecture within your CRA product work.

Review your service architecture Explore Orenda Connect

Product security continues after the machine leaves the factory

The Cyber Resilience Act brings cybersecurity duties across the lifecycle of products with digital elements. The manufacturer needs a defined product, security evidence, vulnerability handling and a support plan. Service access connects those decisions to machines already working at customer sites.

When the maintenance provider changes

Suppose a customer replaces its local maintenance company. The outgoing provider's access must be removed while the new team gets the resources it needs. A technician reading diagnostics and an engineer changing a controller program should not automatically receive the same permissions. Identify the task, approving person and allowed resource before connecting.

With Orenda, organization users and groups provide a basis for those access decisions. Test the expected connection and a resource outside the grant. After permission is removed, test a new connection again. Save the configuration and result in the machine's service records so the next team can understand what was approved.

Make the product lifetime a support decision

A machine expected to run for twelve years can contain a software component whose supplier support ends much earlier. Engineering and purchasing need to decide how that component will be maintained or replaced. Service needs a reliable record of which delivered machines use it, and customers need instructions for the resulting update.

The CRA security-support period reflects expected use and is generally at least five years, with a shorter-use exception. Orenda Box's 10-year hardware availability helps with equipment planning; it does not define the machine's security-support period. Keep the hardware commitment, software maintenance plan and customer support end visible as separate decisions in the product documentation.

Solve the everyday service questions

Who can reach the machine?

Use organization users and groups to grant access to selected applications and devices. Avoid a service process built around shared credentials or unrestricted network access.

What is installed?

Keep the machine identity, supported hardware and application versions linked to product records. Use those records when a component changes or a security correction is needed.

How does support continue?

Define the update owner, customer instructions and support end. Plan hardware availability separately from the software security-support period.

Build on a known access and application environment

Connect provides encrypted access through Diode's peer-to-peer network without public inbound service ports or dedicated hardware. Where local applications are needed, Orenda Box adds a TPM root of trust, signed update releases and 10-year hardware availability. App Market applications use shared identity and permissions approved by the Box administrator.

  1. Define the product's components, external interfaces and service responsibilities.
  2. Grant each service role the applications or device resources required for its task.
  3. Verify approved access, denied operations and access removal against the delivered configuration.
  4. Link the results to the release, support instructions and vulnerability-reporting procedure.

Work to the CRA timetable

Reporting since 11 September 2026

Article 14 reporting duties began on 11 September 2026. Assign an owner and backup for actively exploited vulnerabilities and severe incidents affecting product security.

11 December 2027

The main requirements apply. Connect product design, technical documentation, vulnerability handling and the applicable conformity process.

Support follows expected use

Set the support period around the product's use. Keep supplier support, software releases and customer instructions connected.

Where Orenda fits

Which parts of our CRA work can Orenda support?

Orenda provides private resource access, organization permissions, a local application environment and controlled remote service. Include the deployed configuration and test evidence in your product risk assessment, technical documentation, release process and customer instructions.

Does 10-year hardware availability mean 10 years of security support?

These are separate commitments. Hardware availability supports equipment supply and replacement planning. The manufacturer's security-support period must be established for the product and its expected use, with clear ownership of software maintenance and updates.

Connect the product records

CRA guide for machine builders Reporting, service permissions and support decisions. Build the CRA technical file Trace a delivered machine to components, tests and corrections. Orenda security Identity, encrypted connectivity and access controls.

How does your service team reach a customer machine today?

We can review the connection, permissions and installed applications, then define the Orenda configuration and tests for your product.

Discuss your CRA service architecture
Explore all Orenda solutions →
Cyber Resilience Act 2027: a practical plan for machine buildersPrepare connected machines for CRA 2027. Organize secure access, product records, updates, support and the reporting duties already in force.CRA technical documentation: a working checklist for machine buildersConnect each machine release to its components, risk assessment, security tests and support records. Follow a vulnerability correction through customer delivery.