All certifications
Certification 2 of 3CRA-aligned

CSAFI Product Security Readiness

An independent review of a food-technology maker’s product-security processes, and a sample product version, against the essential requirements of the EU Cyber Resilience Act — evidence that supports, and never replaces, the manufacturer’s own conformity assessment.

Assessed against

  • CRA — Annex I, Parts I and II
  • CRA — Articles 13 and 14
  • IEC 62443-4-1 / 4-2 · EN 18031
  • ISO/IEC 15408 (Common Criteria) for product evidence
stages — triage, process readiness, product evidence review
3
stages — triage, process readiness, product evidence review
requirements — 17 product security, 12 vulnerability handling
29
requirements — 17 product security, 12 vulnerability handling
CRA early warning for exploited vulnerabilities — live since 11 September 2026
24h
CRA early warning for exploited vulnerabilities — live since 11 September 2026
evidence levels for the product review, built on EAL1 and EAL2
2
evidence levels for the product review, built on EAL1 and EAL2
Who it is for

The makers of what a food plant runs on

  • Food-equipment and packaging-machine builders, cold-chain sensor makers, farm-automation vendors, and MES, SCADA and recipe-software firms — the CRA’s “manufacturers”. CSAFI membership is not required.
  • A distributor or system integrator may apply with the manufacturer’s written authority; the manufacturer still holds the certificate.
  • For a food business it is a buying question — “is my supplier ready?” — and can be written into purchasing specifications by name.
  • Food machines often run for 15 to 25 years, so the support period a supplier states is checked against how long the product is really used.
Products in scope

What a food plant connects to its line

All four are “products with digital elements” in the words of the Cyber Resilience Act.

Product typeExamples
SoftwareSCADA, HMI and batch software; manufacturing execution systems; historians; engineering and remote-access software
PLCs and other controllersPLCs, safety controllers, remote input and output modules, drives and motion controllers with network interfaces
FirmwareFirmware of industrial switches, gateways, protocol converters, sensors and actuators used in plants
Automation machinesPackaging, filling, cooking, slicing and processing machines delivered with embedded control
Must-pass

Four things no certificate is issued without

Each one is a CRA duty a food customer will ask about first.

  1. A live reporting process

    Actively exploited vulnerabilities and severe incidents reported through ENISA’s Single Reporting Platform — a 24-hour early warning and a 72-hour notification (Article 14).

  2. A software bill of materials

    A machine-readable list of the components in each product version (Annex I, Part II).

  3. A vulnerability disclosure policy

    A published coordinated disclosure policy and a contact address for reporting flaws.

  4. A stated support period

    A declared period of security updates — normally at least five years — that matches how long the product is used (Article 13).

Stages

Three stages, from triage to the laboratory

A supplier can stop at the stage that answers its customers’ question, or go all the way to laboratory testing.

  1. Triage and classification

    Is the product in the CRA’s scope, and is it a default, “important” or “critical” product? That decides the supplier’s own legal route.

  2. Process readiness

    Secure development, vulnerability handling, incident reporting and support — the manufacturer’s processes, reviewed against Annex I, Part II and Articles 13 and 14.

  3. Product evidence review

    A sample product version evaluated by a laboratory with the Common Criteria method, at Level 1 or Level 2.

Evidence levels

Level 1 or Level 2 — how hard the laboratory looked

The supplier chooses the level; a plant’s purchasing specification decides which level it asks for. The result is pass or fail at the chosen level — no score is published.

Level 1

Common Criteria package
EAL1 — “Functionally tested”
Assurance components
13
What it tells a plant
The version does what its specification and guidance say, has been tested by someone other than the maker, and had no publicly known vulnerability when it was evaluated.
Suited to
Products whose compromise would be contained by plant-level controls; a supplier’s first review.

Level 2

Common Criteria package
EAL2 — “Structurally tested”
Assurance components
19
What it tells a plant
In addition, the maker’s design and tests were examined, and the version withstood a laboratory’s attempts to break it with the effort of a basic attacker.
Suited to
Products that control a critical control point, hold recipes or production parameters, sit at a network boundary, or act as a security control.
What is reviewed

The CSAFI product requirement set

Every requirement is written in CSAFI’s own plain words and traced to the Cyber Resilience Act. Integrity of recipe and setpoint commands, and availability of production lines and cold chains, are treated as food-safety issues.

Product security

17 requirements

Traced to CRA Annex I, Part I

  • Delivered and installed in a secure default configuration
  • Every user and connected system identified; role-based access
  • Control logic, firmware and configuration protected from change
  • Commands and data protected in transit
  • Security events recorded with time and actor
  • Software and firmware updates verified before they install
  • Essential control functions keep working, or fail safe

Vulnerability handling and support

12 requirements

Traced to CRA Annex I, Part II and Article 13

  • A software bill of materials for the version
  • A documented process to receive, triage and fix vulnerabilities
  • A published disclosure policy and contact address
  • Security updates distributed securely, free and without delay
  • A declared support period for the version
  • Changes and patches notified to CSAFI

Already IEC 62443, Common Criteria or EUCC certified?

Existing results are reused. A version with a valid Common Criteria or EUCC certificate has been through the same method, so only the gaps against CSAFI’s requirements are reviewed.

The process

From application to certificate

The same twelve-step shape as the site certifications, with a laboratory in the assessor’s place and the supplier in the site’s.

  1. Readiness check (optional)

    Supplier

    Complete the readiness questionnaire before applying.

  2. Application, per version

    Supplier

    Apply for one exact product version.

  3. Review and conflict screen

    CSAFI

    Stage, level, laboratory and minimum duration confirmed within 10 working days.

  4. Agreement and plan

    Supplier, CSAFI, laboratory

    The agreement is signed and the evaluation plan issued.

  5. Statement of security claims

    Laboratory

    The laboratory accepts what the product claims to do.

  6. Evaluation

    Laboratory

    Processes, design, guidance, testing and a vulnerability analysis.

  7. Findings resolved

    Supplier, with the laboratory

    Every finding closed; the whole evaluation within 12 months.

  8. Technical report

    Laboratory

    The report and evidence index go to CSAFI.

  9. Quality review

    CSAFI reviewer

    Somebody with no part in the evaluation checks the whole file.

  10. Decision

    Independent panel

    Five members decide; the reviewer does not vote.

  11. Issuance

    CSAFI

    The certificate, its public summary and the register entry.

  12. Maintenance

    Supplier, laboratory, CSAFI

    Change and patch notices, and a yearly process check.

  13. Re-review

    Everyone, as steps 4 to 10

    A new certificate for the current version.

Using the certificate

Where the CSAFI product mark may — and may not — appear

  • On that exact version’s documentation, release notes and data sheet.
  • Never on the device itself, its packaging, its nameplate or its user interface — and never next to, or looking like, a CE mark.
  • Never carried over to another version. A new version is covered through maintenance or a new review.
Plain about the claim

What this certificate can — and cannot — say

It can say

  • “CSAFI Product Security Readiness: independent review of [product and version] against Annex I and Articles 13–14 of the Cyber Resilience Act, as at [date].”
  • A readiness level for the stage reached.
  • Evidence prepared to support the manufacturer’s own conformity assessment.
  • Aligned with IEC 62443-4-1 / 4-2, EN 18031 and ETSI EN 303 645.

It never says

  • “CRA certified”, “CRA compliant”, “CRA approved” or a “CRA conformity certificate”.
  • “Notified” or “accredited”.
  • Any logo that resembles the CE mark, or sits next to it on a nameplate.
  • “Meets the CRA” — except as a dated, scoped opinion.

Get a product ready for the CRA

Register interest and the CSAFI team will talk you through the stages, the evidence a laboratory will need and how the first products will be reviewed.

This is not an EU conformity assessment, EU-type examination certificate or EUCC certificate. CSAFI is not a notified body. It does not confer a presumption of conformity, authorise CE marking, or replace the manufacturer’s EU Declaration of Conformity.

CSAFI certifications are independent industry assessments. They are not regulatory approvals, do not replace a company’s legal obligations, and are not EU conformity assessments or CE marking. CSAFI is not a notified body, and CSAFI certificates are not accredited. PAS 96 is published by BSI; CSAFI is not affiliated with BSI.