Connect product security with secure plant operation
In energy, water, transport and other critical sectors, security updates need to work with operational requirements. Operators need reliable information on versions, support, vulnerabilities and secure operating conditions. Solvetronix supports the technical assessment of that information and the planning of suitable measures.
Discuss product security for your equipmentCRA and NIS2 address different responsibilities
The CRA addresses products and the economic operators involved. NIS2 concerns covered entities and their cybersecurity management; scope and national implementation require separate assessment. Purchasing a product does not automatically make an operator its CRA manufacturer. Own-brand marketing, import or substantial modifications may create additional roles.
Operators should therefore establish procurement and operational requirements for product identification, support end dates, vulnerability contacts, update information and available evidence. CRA evidence alone does not satisfy an operator's NIS2 duties. Solvetronix provides the regulatory assessment.
A gateway at a water utility
An existing gateway is to gain remote maintenance access. The assessment covers segmentation, permissions, secure service access, update windows and fallback operation. It also determines whether the modification is relevant under the CRA and which party holds each role. Use at a water utility alone does not determine the CRA product category. This is an illustrative example.
What Solvetronix helps you establish
- Technical requirements for procurement and supplier discussions.
- An assessment of firmware, remote access and update capabilities within the agreed scope.
- Documented options for continued operation, protection and retrofit.
Legal basis and sources
General information and technical guidance. The specific assessment depends on the product, role and use. Reviewed 22 October 2026.