CRA reporting is in force: how OT operators can respond.

A vendor advisory is not an implemented control. In production networks, product and version must be mapped to an asset, reachability checked and action agreed with operations. A maintained process matters more than the raw volume of reports.

What has applied since 11 September 2026

Article 14 of the Cyber Resilience Act has applied since 11 September 2026. Manufacturers of in-scope products must report actively exploited vulnerabilities and severe incidents affecting product security. Not every newly discovered vulnerability triggers the same duty.

The Single Reporting Platform addresses the coordinating CSIRT and ENISA. Early warnings and notifications are due within 24 and 72 hours of awareness. The final report is due no later than 14 days after a fix becomes available for an actively exploited vulnerability; for a severe incident it is due within one month of the 72-hour notification, not simply one month after the incident.

What operators should check in vendor advisories

Manufacturers establish reporting channels, deadlines and documentation. Operators assess which vendor advisories affect their plant and which measures are technically and operationally possible. Reports to authorities and information for affected users have different recipients; an advisory and support process remains necessary.

A control PC running a line does not get rebooted on Tuesday evening. The plant has an approval, often a certification, sometimes a manufacturer warranty tied to a specific software state. The patch is therefore not a matter of hours but of months — and the gap between report and maintenance window has to be bridged.

Zones and conduits: the model that buys time

IEC 62443 describes an approach to industrial security. A zone groups assets with common security requirements. A conduit groups controlled communications between zones. Unintended connections must be found and restricted; a zone diagram alone does not prevent them.

The standard adds security levels SL 1 to SL 4 describing which class of adversary a zone should withstand — from accidental misuse to a determined, well-resourced attacker. The practical value lies less in the number than in the discussion it forces: for every zone somebody has to decide how well protected it should be, and that decision gets recorded.

Reachability affects vulnerability assessment. A verified, restricted communication path can reduce exposure compared with a flat network. Exploitability, potential consequences and control effectiveness determine whether this is sufficient until the maintenance window. Segmentation does not provide blanket permission to postpone fixes.

From the Purdue model to the actual cut

Most production networks carry remnants of a Purdue model: a notional layering from field level up to enterprise IT. In reality the layering is rarely clean — an HMI reaches straight into a PLC, a maintenance laptop sits on the plant and the office network at once, a cloud service pulls operating data out of a cell. Those shortcuts are usually well justified and almost always undocumented.

The path from model to defensible cut is therefore not architecture but discovery:

1. 01

   Passive asset inventory

   Review existing inventories and passively collected traffic. Active queries can affect sensitive devices and require platform-specific agreement. Unobserved devices remain an inventory gap.

2. 02

   Criticality per plant section

   Not every cell matters equally. The rating comes from production, not from IT — it later decides which zone carries which security level.

3. 03

   Cut zones along function

   Cells, lines, supervisory level, remote maintenance, building services. The cut follows what produces together, not what was cabled together.

4. 04

   Name and narrow the conduits

   Every remaining relationship gets a path, a protocol and a direction. What is left is the exception list — and it is always shorter than everyone expects.

5. 05

   Remote maintenance as its own zone

   Vendor access is not a side note but the most used path from outside to inside. It belongs in a dedicated zone with its own authentication, time windows and logging.

6. 06

   Prove it, then repeat it

   The zone cut is tested like any other rule: defined cases showing that one zone cannot reach another. After that the test belongs in the routine.

From an incoming report to a decision

When a relevant vendor advisory arrives, the processing chain determines whether it leads to an actionable control. Four questions should be answerable without launching another discovery project:

• Does it affect us? Do we run the reported product in the reported version — and where exactly? Only the asset inventory answers that.
• How reachable is it? Which zone does the device sit in, which conduits lead there, which protocols are permitted?
• What carries us until the window? Narrow the conduit further, block a protocol, time-box access — the compensating control is documented, not improvised.
• When is it fixed? A date with an owner, not “at the next shutdown”.

If those four questions cannot be answered within a working day today, you do not have a reporting problem. You have an inventory problem, and the CRA stage merely makes it visible.

What belongs in contracts now

Procurement is the second lever and it works more slowly than technology — which is why it has to start earlier. Three points are realistically negotiable today: a software bill of materials (SBOM) for delivered components, a committed response time for security-relevant fixes across the agreed service life, and explicit permission to install security updates without losing warranty claims.

The last point matters most in practice. It helps little if a manufacturer reports and fixes in line with the CRA while the operator is not allowed to install the fix without endangering plant approval.

If the evidence base is missing, start with an OT assessment. Communication relationships and permitted transitions can then be constrained and tested through OT segmentation.