No. 77: Can Devices Using CAN or Modbus Be CRA-Compliant?
Yes, with some caveats. The component manufacturer must inform the integrator about usage restrictions and relevant parts of the risk assessment. If together they cannot reduce the risk to an acceptable level, they must find another solution with stronger security.
Read next
A Pragmatic Approach to CRA Risk Assessment
In less than 30 minutes, I can explain a pragmatic approach how to model the threats of an embedded system, assess the cybersecurity risks and document the risks in security decision records (SDRs). Here is the video from my talk at the Torizon CRA Summit in Munich.