The increasing digitization and connectivity of machines and systems opens up enormous potential for efficiency, flexibility, and new business models, but it also carries risks. Cyber attacks on industrial control systems are no longer a rarity and can lead to production downtime, data loss, reputational damage, and even threats to physical safety.
Against this backdrop, legal requirements such as the Cyber Resilience Act (CRA), the Machinery Regulation (MVO), and the RED-DA Directive are becoming a key focus for the industry. These regulations require machine manufacturers and operators to address cyber security systematically and in a verifiable manner − from development through commissioning to ongoing operation and decommissioning of machines. But how can companies efficiently implement these requirements, address vulnerabilities, and simultaneously maximize customer value? A holistic approach combining technology, processes, and partnerships ensures that machine manufacturers and operators are future-proof.
Companies are now required not only to implement technical protective measures but also to establish organizational processes that ensure, among other things, continuous vulnerability management, the conduct of systematic risk analyses, and employee training. As a partner to industry, Lenze specializes in providing its customers with comprehensive support along this journey. At the heart of this approach is the conviction that cyber security is not an end in itself, but can deliver real added value for customers. The consistent implementation of these legal requirements minimizes liability risks, protects reputation, secures access to international markets, and also provides a competitive advantage.
Lenze itself has been certified by TÜV Rheinland in accordance with IEC 62443-4-1 since 2025 and thus meets the international requirements for a secure development process for industrial drive and automation products. The certification confirms that cyber security is implemented as an integral part of the entire product lifecycle – from design through maintenance. It is regarded as an internationally recognized seal of quality and, with Lenze as a partner, gives machine builders access to projects with high cybersecurity requirements.
Regular risk analyses are a key element in implementing security requirements. The Cyber Resilience Act mandates a risk-based approach, under which companies must identify and assess threats and risks in their products and use this information to develop appropriate measures. That is why machine builders need support in conducting risk analyses and developing customized security concepts. The goal is to implement targeted measures that protect against data loss, knowledge theft, tampering, and machine downtime – and to avoid high costs in the event of an emergency.
Technical safeguards form the foundation of any security strategy. Depending on the concept, these may include, for example, access controls, encrypted communication, or regular updates. Lenze integrates these features into its products while ensuring a high level of user-friendliness and easy commissioning. Tampering is detected through audit logs, know-how is protected through encryption, and system failures are prevented through access controls. For customers, this means they receive secure, easy-to-use solutions that reduce the workload on their own team and increase machine availability.
Security requirements do not end with the delivery of the product. A key element of the new regulatory landscape is vulnerability management. Starting in September 2026, the CRA requires companies to report actively exploited security vulnerabilities to an ENISA reporting platform (European Union Agency for Cybersecurity) and, starting in December 2027, to implement structured vulnerability management for the duration of the support period. This means that component manufacturers and machine builders must continuously monitor and assess their machines and components and inform their customers about relevant risks. To this end, Lenze has established a Product Security Incident Response Team (PSIRT) that proactively identifies and assesses security vulnerabilities, responds quickly to exploitable vulnerabilities, and communicates them through various channels.
Machine builders can access information about vulnerabilities in Lenze products on the CERT@VDE website and in CSAF format. At the same time, countermeasures are analyzed and made available via firmware updates. To do this efficiently, Software Bills of Materials (SBOMs) have been created, which contain a detailed list of all software components, libraries, and dependencies in each product. This allows risks and vulnerabilities to be tracked automatically and legal requirements to be met efficiently. For customers, this means they benefit from transparency, a rapid response in the event of an emergency, and the ability to easily meet their own compliance requirements.
An often underestimated factor for success is employee training. Cybersecurity is not just a matter of technology, but also of organization. Regular training on regulatory requirements and the state-of-the-art in security is highly recommended. Lenze supports its customers with practical training sessions, white papers, and checklists to help teams stay up to date.
Another key point: Open communication with customers, suppliers, and partners is crucial for aligning requirements and openly discussing security. Lenze is active in industry associations such as the VDMA and ZVEI and promotes open innovation and partnerships. In addition, Lenze regularly organizes its own events to keep machine builders informed about the latest developments in cybersecurity. Interoperable, future-proof solutions and a strong network increase flexibility and competitiveness—especially for small and medium-sized enterprises.
The bottom line is this: Cyber security is no longer just an IT issue, but a key factor in product development, a driver of competitiveness, and a catalyst for innovation across many types of products. Those who invest in implementing security requirements today not only meet legal requirements but also lay the foundation for sustainable market success. Lenze supports machine builders on this journey − with expertise, products, and a strong network. Customers benefit from efficient compliance, rapid response in emergencies, future-proof and scalable solutions, and security updates. In this way, cyber security becomes a genuine benefit for customers and the foundation for sustainable success in industrial automation.
