Sarah Fluchs

🚨 Cyber Resilience Act (CRA) – A game changer for machine builders 🚨 Starting in 2027, no machine can be delivered in the EU without a proper vulnerability handling process in place. This includes: ✔️ Setting up a vulnerability reporting contact ✔️ Reporting confirmed vulnerabilities within 24h to the ENISA Vulnerability Reporting Platform ✔️ Coordinated disclosure and patch management The CRA makes cybersecurity a mandatory part of CE compliance. If not implemented ➝ ❌ No CE marking, no delivery to customers. This is a major shift for all manufacturers in the machinery and automation sector. At GROLLMUS, we help you understand and prepare for these requirements – so your machines remain compliant and secure. 👉 How are you preparing for CRA 2027? #CyberResilienceAct #Cybersecurity #IndustrialAutomation #ENISA #CE

159

12 Kommentare

Hydrothermal origin of life: The chemical and thermal dynamics in hydrothermal vents makes such environments highly suitable thermodynamically for chemical evolution processes to take place. Therefore, thermal energy flux is a permanent agent and contributed to the evolution of the planet, including prebiotic chemistry. Günter Wächtershäuser proposed the iron-sulfur world theory and suggested that life might have originated at hydrothermal vents. Wächtershäuser proposed that an early form of metabolism predated genetics. By metabolism he meant a cycle of chemical reactions that release energy in a form that can be harnessed by other processes. It has been proposed that amino acid synthesis could have occurred deep in the Earth's crust and that these amino acids were subsequently shot up along with hydrothermal fluids into cooler waters, where lower temperatures and the presence of clay minerals would have fostered the formation of peptides and protocells. This is an attractive hypothesis because of the abundance of CH4 (methane) and NH3 (ammonia) present in hydrothermal vent regions, a condition that was not provided by the Earth's primitive atmosphere. A major limitation to this hypothesis is the lack of stability of organic molecules at high temperatures, but some have suggested that life would have originated outside of the zones of highest temperature. There are numerous species of extremophiles and other organisms currently living immediately around deep-sea vents, suggesting that this is indeed a possible scenario. Experimental research and computing modeling indicate that the surfaces of mineral particles inside hydrothermal vents have similar catalytic properties to enzymes and are able to create simple organic molecules, such as methanol (CH3OH) and formic acid (HCO2H), out of the dissolved CO2 in the water. https://lnkd.in/giB4ZWBa

1.601

31 Kommentare

🎇 BSI-Grundschutz to OSCAL: The Automated Conversion Pipeline Available on GIT: https://lnkd.in/eNwPHNhf This project provides a powerful, automated pipeline for converting BSI-Grundschutz "Baustein" (building block) PDF documents into a rich, structured, and OSCAL-compliant JSON format. It leverages the advanced capabilities of Google's gemini-2.5-pro model to not only translate the content but also enrich it with a multi-level maturity model and contextual information, making the final catalog immediately useful for analysis and compliance management. The system is designed as a serverless Google Cloud Run Job and operates incrementally. It intelligently reads an existing master OSCAL catalog, processes new or updated PDFs, and seamlessly merges the results by adding new "Bausteine" or overwriting existing ones. ⭐ Key Features ➕ Translation of the BSI Baseline Protection Manual Edition 2023 in 14 Languages ➕ Fully Automated Conversion: Converts raw PDF content into structured OSCAL JSON without manual intervention. ➕ Incremental Updates: Intelligently adds new or overwrites existing building blocks in a master catalog file, making the process repeatable and efficient. ➕ Contextual Enrichment: Extracts introductory chapters (Introduction, Objective, Modeling) and the complete threat landscape into structured parts, providing important context directly within the catalog. ➕ G++ Compliant Practices: Each control is categorized into one of the defined practices. ➕ WiBA-Compliant Checklists: The viewer supports checklists like WiBA. They can be saved and loaded as JSON files. Filters work on them, allowing a user, for example, to run the checklist for all basic controls in the ISMS implementation phase. ➕ OSCAL-Compliant Control Classes: Each control is assigned a class based on the official OSCAL specification. ➕ BSI Level: Each control is assigned a level based on the BSI-Grundschutz categories Basic, Standard, and High, in the new G++ compliant levels 1 to 5. ➕ 5-Level Maturity Model: Generates five different maturity levels for each individual requirement, enabling a granular assessment beyond simple compliance. ➕ ISMS Phase Mapping: Assigns each requirement to a phase of the ISMS lifecycle (e.g., Implementation, Operation) for better process integration. Protection Goal Analysis (CIA): Determines whether a control affects Confidentiality, Integrity, or Availability. #bsi #grundschutz #baseline #security

52

19 Kommentare

Quick update on recent release of ISO/IEC 42006 What is ISO/IEC 42006? ISO/IEC 42006 sets out the additional requirements for bodies that audit and certify artificial intelligence management systems (AIMS) according to ISO/IEC 42001. It builds on ISO/IEC 17021-1 and ensures that certification bodies operate with the competence and rigour necessary to assess organisations developing, deploying or offering AI systems. Why is ISO/IEC 42006 important? AI systems present unique challenges in areas like ethics, data quality, risk, and transparency. To certify that an organisation responsibly manages these challenges, auditors themselves need specialised knowledge and clear rules for conducting assessments. ISO/IEC 42006 ensures that the audit and certification of AI management systems is performed consistently and credibly, giving customers and stakeholders confidence that certified organisations meet the expectations set out in ISO/IEC 42001. Benefits -Clearer expectations for certifying bodies evaluating AI management systems -Greater trust in AIMS certification results -Support for robust, consistent auditing of AI-related risks and controls -Increased transparency and confidence for customers and regulators

29

3 Kommentare

Machine Operators are already asking for cyber-secure machines. But many machine builders are still learning what that even means. The Cyber Resilience Act will close that gap - brutally fast. Here are the top requirements that every machine builder must internalize - not as constraints, but as enablers for trust, differentiation, and market access: - Network structuring & segmentation: Machines need to coexist securely within industrial networks. - Firewall + secure VPN solutions: Remote access must be controlled and encrypted. - Transparency down to the bus level: From higher-level networks into fieldbus / device layers. - Update management / patching: You must deliver security updates over the lifecycle of the machine. - Security certifications & threat analyses: Prove your resilience and anticipate vulnerabilities. - Prohibition or control of USB & personal engineering PCs: Lock down potential intrusion paths. - Access management to OT devices: security by default with strong user passwords. - Integration into threat detection systems: Make your machines observable, not opaque. These points are now obligations and soon law, not just best practices. Because in the EU, the Cyber Resilience Act (CRA) will require that products with digital elements - including controllers, software, connected components - meet cybersecurity requirements from design through the complete machine lifecycle. The CRA entered into force on 10 December 2024, and most obligations become applicable from 11 December 2027. ⚠️ Implication for machine builders: ➡️ You will no longer just deliver machines — but secure digital platforms. ➡️ If you treat these requirements as “extra work,” you risk being locked out of markets or becoming liability risks. ➡️ If you treat them as differentiators, you open doors: trust, premium positioning, and safer adoption of your solutions. 🔧 I’m curious: Which of these requirement areas do you think will hit your business hardest — and why? #cybersecurity #automation

74

4 Kommentare