Premio Product Security & Cyber Resilience

The Cyber Resilience Act, CRA, is a European Union regulation that introduces cybersecurity requirements for products with digital elements placed on the EU market. It is designed to improve product security across the full lifecycle, including design, development, production, vulnerability handling, security updates, and customer documentation.

Industrial edge computers are increasingly connected to operational technology networks, AI workloads, remote management systems, and distributed infrastructure. The CRA reinforces the need for secure product development, software component visibility, vulnerability management, security updates, and lifecycle documentation for connected hardware and software products.

The timeline for compliance is structured as follows:

• December 10, 2024: The Cyber Resilience Act officially entered into force.
• September 11, 2026: Reporting obligations begin to apply. From this date forward, manufacturers are required to report actively exploited vulnerabilities and severe security incidents.
• December 11, 2027: The main obligations introduced by the CRA become fully applicable

Premio is actively preparing for CRA requirements. Full CRA product compliance obligations apply from 11 December 2027. Product-level CRA conformity will depend on the applicable product scope, configuration, classification, documentation, and assessment requirements.

Premio is strengthening product security practices across secure development, vulnerability handling, SBOM management, security updates, product security documentation, and conformity assessment planning. Premio’s existing IEC 62443-4-1 certification provides a strong secure development lifecycle foundation for CRA readiness.

Premio currently maintains ISO 9001:2015, ISO 13485:2016, ISO 14001:2015, and IEC 62443-4-1 certifications. Among these, IEC 62443-4-1 is especially relevant because it supports secure product development lifecycle processes.

No. IEC 62443-4-1 supports Premio’s secure product development lifecycle, but CRA also requires product-level assessment, vulnerability handling, documentation, security update management, and conformity evaluation based on the applicable product category and configuration.

PSIRT stands for Product Security Incident Response Team. Premio’s PSIRT process coordinates the review, assessment, mitigation, and communication of potential product security vulnerabilities. For PSIRT inquiries, please contact psirt@premioinc.com.

If you believe you have identified a potential security vulnerability affecting a Premio product, please contact Premio’s Product Security Incident Response Team, PSIRT, at psirt@premioinc.com. To help us review the report efficiently, please include the product model, software or firmware version, vulnerability description, potential impact, and reproduction steps where available.

When reporting a vulnerability to psirt@premioinc.com, please include as much relevant information as possible, such as product model, serial number if applicable, BIOS or firmware version, OS image version, driver or software version, system configuration, vulnerability description, potential impact, reproduction steps, supporting logs or screenshots, and CVE ID if available.

Premio will review the submitted information, validate whether the issue may affect Premio products, assess the potential impact, coordinate with internal teams or suppliers as needed, and determine appropriate mitigation, patch, documentation, or customer communication steps.

Premio is establishing a product security advisory process to communicate relevant vulnerabilities, affected products, mitigation steps, update availability, and customer actions where appropriate.

Premio will provide security advisories through its official product security resources. For questions related to a specific advisory or suspected vulnerability, please contact psirt@premioinc.com.

CVE, Common Vulnerabilities and Exposures, is a public identifier for a known cybersecurity vulnerability. KEV, Known Exploited Vulnerability, refers to a vulnerability that has been observed being actively exploited in the real world. Premio is reviewing processes to monitor CVEs and KEVs that may affect supported product configurations.

SBOM stands for Software Bill of Materials. It is a structured inventory of software and firmware components included in a product configuration. SBOM management helps identify affected components when vulnerabilities are discovered and supports vulnerability analysis, patch planning, and lifecycle security documentation.

Premio is reviewing SBOM management processes for supported product configurations. SBOM availability may depend on product family, software configuration, customer requirement, and applicable regulatory requirement.

Premio security updates may vary by product and affected component. Updates may include BIOS updates, firmware updates, OS image updates, driver updates, software utility updates, OOB management firmware updates, configuration guidance, temporary mitigations, or updated documentation.

Security support periods may vary by product family, product lifecycle status, software configuration, supplier support, and applicable regulatory requirements. Premio is reviewing how to provide clearer product security support period information for applicable products.

CRA applicability depends on product scope, configuration, intended use, and how the product is placed on the EU market. Premio is reviewing product classification and conformity assessment requirements across applicable product families.

For potential product security vulnerabilities or PSIRT-related inquiries, please contact Premio PSIRT at psirt@premioinc.com. For general CRA, compliance, sales, or technical support questions, please contact Premio through the appropriate sales or support channel.