Industrial Cybersecurity TRAINING for Machinery Design:
EU Machinery Regulation & Cyber Resilience Act Implementation for Design Engineers

HOW THE TRAINING IS STRUCTURED

Rather than looking at cybersecurity in isolation, the seminar follows the machine life cycle. It shows which requirements, design decisions and responsibilities are relevant in each phase.

1. Cybersecurity becomes part of machine design
   Why the CRA and the EU Machinery Regulation fundamentally change the development process
    
2. Understand the EU Machinery Regulation & CRA in concrete terms
   Which requirements are truly relevant — and what they mean in practice
    
3. Cybersecurity across the machine life cycle
   Which tasks and responsibilities arise in each phase
    
4. Risk analysis in the engineering context
   How risks are assessed — and the role design engineers play
    
5. Implement Security by Design
   Which design decisions ensure cybersecurity from the very beginning
    
6. Clarify handover and responsibilities
   Which information must be handed over — and who is responsible for what
    
7. Takeaways for direct implementation
   How to transfer the content into your day-to-day engineering work

Why cybersecurity is now part of machine design

Cybersecurity is no longer an optional topic. It is becoming an integral part of machine development. In this introduction, you will learn why new requirements such as the EU Machinery Regulation and the Cyber Resilience Act directly affect design engineers.

• Why the EU Machinery Regulation and CRA directly affect design engineers
• Common misconceptions in machine design and engineering
• The role of design engineers in the context of cybersecurity
• Cybersecurity as a new quality criterion in machine design

Contents:

• Why cybersecurity is no longer optional
• What has changed with the EU Machinery Regulation and CRA
• Why traditional engineering approaches are no longer sufficient

What the EU Machinery Regulation and CRA mean in practice

You will get a clear overview of the regulatory obligations and what they mean for machine development in practice. The focus is on understanding responsibilities and implementation requirements — not on the technical details of individual standards.

• Overview of the EU Machinery Regulation
• Overview of the Cyber Resilience Act
• Security by Design and Security by Default
• Legal obligations vs. standards such as IEC 62443

Contents:

• Clarity on key regulatory obligations
• Understanding the difference between legal requirements and standards such as IEC 62443
• Practical understanding of obligations — without getting lost in legal detail

The machine life cycle as a cybersecurity roadmap

Cybersecurity is not implemented at a single point in time. It must be considered throughout the entire machine life cycle. In this module, you will learn which requirements, tasks and responsibilities are relevant in each phase.

• Machine life cycle: from concept to decommissioning
• Cybersecurity obligations in each life cycle phase
• Typical mistakes during the course of a project
• Excursus: retrofit — when a new CE conformity assessment may be required

Contents:

• Cybersecurity as an ongoing life cycle task — not a one-off activity
• Understanding how responsibilities change over time

Risk analysis: the role of machine design

Cybersecurity risk analysis is a key building block for practical implementation. In this module, you will learn what role machine design plays in this process — and how risk analysis leads to concrete design decisions.

• Difference between risk analysis for safety and cybersecurity
• Correctly defining the System under Consideration (SuC)
• Security Level as an expression of risk reduction objectives
• What design engineering contributes — and what management decides
• Practical exercise: identifying risks and deriving design decisions using a machinery example

Contents:

• Understanding cybersecurity risk analysis without going into methodological detail
• Focus on the role of design engineering in the overall process

Security by Design: key design decisions

Cybersecurity starts with fundamental architecture and design decisions. In this module, you will learn practical principles that can be applied directly in machine development.

• Architecture and segmentation: zone-based thinking
• Roles, users and service access
• Secure default settings
• Update and patch capability as a design requirement
• Remote maintenance: technical feasibility vs. organizational control

Contents:

• Concrete and actionable design principles
• Architectural thinking instead of network engineering details

Handover, documentation and responsibilities

Cybersecurity does not end with commissioning. In this module, you will learn which information must be handed over and how responsibilities between manufacturer and operator can be clearly defined.

• Handover of the machine from a cybersecurity perspective
• Security information required by the operator
• Documentation for secure and compliant operation
• Typical gaps and project risks
• Clear assignment of responsibilities during operation

Contents:

• Understanding the importance of the handover phase
• Clear separation of responsibilities between manufacturer and operator

Summary and key takeaways

At the end of the seminar, the most important insights are consolidated and translated into concrete next steps. The goal is to help participants apply what they have learned directly in their day-to-day engineering work.

• Key takeaways for design engineers
• Do’s and don’ts in machine design
• Concrete next steps for day-to-day work
• Open questions and discussion

Contents:

• Consolidation of the key insights
• Transfer into day-to-day engineering practice