Cyber Resilience Act (CRA) strategy for rail
Customer: ErvoCom, Switzerland
Project tasks
- Developing a conformity strategy for the Cyber Resilience Act (CRA)
- Defining specific controls and mandatory processes
- Supporting communication and documentation requirements towards original equipment manufacturers (OEMs)
- Establishing a practical approach for CRA implementation
- Establishing security risk management
- Assisting in defining CVD policy, vulnerability management process, intended purpose and integration constraints
Our approach
PROSE supported ErvoCom in developing a tailored strategy for compliance with the Cyber Resilience Act (CRA). The existing compliance strategy, including product strategy, vulnerability management and reporting processes were analysed, and complemented with interviews involving management, product management and engineering.
In addition, we reviewed relevant sector guidance from UNIFE, VDB and the European Commission and used the findings to develop a documentation strategy and implementation approach. We also verified the proposed approach against the requirements of train manufacturers, adjusted the compliance timeline and supported the customer in resolving open implementation and compliance questions.
Customer benefit
ErvoCom gained a clear and tailored strategy for implementing the Cyber Resilience Act, with greater clarity on mandatory processes, controls and documentation requirements. The structured approach provides a basis for communicating CRA compliance towards train manufacturers and supports the scalability of the company’s compliance activities as its business develops.
PROSE provided an independent railway perspective across regulatory, product and engineering considerations, helping the customer translate compliance requirements into practical next steps.
