NEWFree EU CRA product check · Nov 30Apply →
Security by industryPhysical AI product security roadmap

Manufacturing & industrial equipment
security compliance roadmap

When the line stops, the losses start immediately

We test whether factory equipment and industrial machinery can be manipulated or stopped from outside, and support you all the way through meeting security requirements.

For · Industrial equipment manufacturers · smart factory operatorsRegulations · EU Machinery Regulation · EU CRA · IEC 62443
Checking whether the office network can reach the PLC
ROADMAP

Building industrial equipment security, from design to post-market

This is the industrial equipment security architecture ZIEN proposes. Protecting every layer of the device takes specific tasks at each stage.

Applies from Jan 20, 2027
EU Machinery Regulation (EU) 2023/1230Cybersecurity requirements that keep control systems from behaving dangerously under external attack become part of the essential safety requirements.
01

Design

  • Threat modeling
  • Security requirements definition (Machinery Regulation · CRA)
02

Development

  • Secure product development framework (SPDF)
  • SBOM creation & management
03

Verification

  • Security risk assessment
  • Penetration & fuzz testing
04

Certification & conformity

  • Machinery Regulation conformity assessment
  • CRA technical documentation & EU declaration of conformity
Launch
05

Post-market

  • Coordinated vulnerability disclosure (CVD) · PSIRT
  • Security updates & retesting
  • CRA vulnerability & incident reporting Mandatory from Sep 2026
What we protect
Every device layer
  • Control systems (PLC · HMI)
  • Industrial communication protocols
  • Remote maintenance · gateways
  • Firmware · debug ports
WHAT WE SOLVE

The tasks on your roadmap, solved by ZIEN

EU Machinery RegulationEU CRAIEC 62443We prepare the cybersecurity documentation needed for conformity assessment with three solutions
Design · Verification · Conformity

Z-PEN

Offensive security experts break into your deviceWe attack the actual device and firmware, and turn the vulnerabilities we find into evidence for conformity assessment.
  • Threat model
  • Security risk assessment
  • Security test report (penetration testing & fuzzing)
Secure SDLC

Z-Series

Automated protection from the development stageAutomated firmware analysis, SBOM management and vulnerability remediation alongside your developers — all in one flow.
  • Automated firmware analysis & continuous assessment (Z-IoT)
  • SBOM generation & management (Z-BOM)
  • Vulnerability remediation & management with your developers (Z-ONE)
  • Support for running your SPDF
Post-market

PSIRT

With you to the end, even after launchWe take in vulnerabilities reported after launch and run disclosure, patching and retesting for you.
  • Vulnerability handling process (CRA)
  • CVD policy operations
  • Security update & retest response
PARTNER

We work with Bureau Veritas, a global certification body

In January 2026, we signed a product cybersecurity cooperation MOU with Bureau Veritas.

Read the MOU news (Korean) →
ZIENBureau Veritas
FAQ

Frequently asked questions

QWhich regulations do you cover?View details ▾

We prepare you based on the EU Machinery Regulation ((EU) 2023/1230, applicable from January 2027) and the EU CRA, in line with IEC 62443, the industrial control system security standard.

01EU Machinery Regulation02EU CRA03IEC 62443
QIs our equipment subject to the Machinery Regulation's security requirements?View details ▾

If software or a network connection plays a part in the machine's safety functions, it needs to be reviewed. We work with you to determine applicability for each product, based on the Annex III requirements for protection against corruption (1.1.9) and safety and reliability of control systems (1.2.1).

01Equipment configuration review02Requirement mapping03Applicability decision
QBy when do we need to be ready?View details ▾

The EU Machinery Regulation applies from January 20, 2027. Design changes and technical documentation take time, so it's best to work backward from your launch schedule and start planning now.

01Current-state assessment02Design changes03Technical documentation
QDo you test lines that are in operation?View details ▾

We test after agreeing on downtime windows and the test environment, so production isn't affected.

01Safety conditions agreed02Testing during downtime03Test environment
QDo you also handle questions from the certification body?View details ▾

We prepare supporting evidence and answers for security-related questions raised after submission.

01Question analysis02Supporting evidence03Drafting answers
QDo you test control equipment such as PLCs and HMIs?View details ▾

Yes. We test the control equipment's firmware, communication paths, and HMI and remote access points in the order a real attacker would, to see whether any path reaches the PLC.

01Firmware02Communication paths03Remote access
QDo we need to prepare an SBOM?View details ▾

The EU CRA requires a list of the software components in your product (SBOM). With Z-BOM, you can extract components from firmware and produce the list in the standard SPDX or CycloneDX formats.

01Component extraction02Standard format conversion03Vulnerability matching
QIs management needed after launch, too?View details ▾

Yes. The CRA requires vulnerability handling and security updates throughout the support period, and from September 2026, actively exploited vulnerabilities must be reported. When a new CVE appears, we find the affected products and carry it through to remediation.

01CVE monitoring02Affected product identification03Remediation · reporting
QWhat deliverables do we receive?View details ▾

A test report with reproduction steps, together with security evidence to include in your technical documentation.

01Test report02Security evidence03Retest after remediation
CONTACT

Tell us about your equipment and operating environment

Just tell us what to test — we'll reply within 5 business days with a proposed scope and timeline.

support@zi-en.io · +82-70-4571-9854