Newsletter - Small Step Systems

Every third Monday of a month, I'll share my hands-on experience in building usage-defined machines and IoT devices. You can watch how my understanding of hot topics evolves, before these topics are ready for posts or talks. You’ll get insights into current projects, book reviews, discussions of articles and videos by other people and companies, and more.

Latest posts

Mar 16, 2026 members

No. 71: Commission Guidance on the CRA - Placing on the Market

Feb 23, 2026 members

No. 70: License Violations Likely to Cut Into Your Profits

Dec 30, 2025 members

No. 69: Who Defines Minimum Security for Default Products?

Courts will do it! Cybersecurity experts throw a lot of security measures at the wall and see which ones stick. They seriously suggest that manufacturers must only do a "proper" risk assessment and all is fine. Manufacturers define what "proper" means. Isn't that circular reasoning?

Nov 19, 2025

No. 68: New Offering - CRA Survival Bootcamp

Are you ready for the Cyber Resilience Act? If not sure, check out my new offering. In the CRA Survival Bootcamp, you'll learn how to do CRA compliance on your own. My related posts may help you as well.

Oct 20, 2025 members

No. 67: Risk Assessment of Essential Product Requirements: Documenting Risks

The CRA requires manufactures to document the risk assessment. Architecture decision records (ADRs) are the ideal means for that. They also facilitate good discussions about different mitigation options.