The world’s first accredited IACS cybersecurity Certification Body launches a structured, template-driven, engineering tool designed to streamline product risk assessments and technical documentation ahead of the December 2027 CRA deadline.
SELLERSVILLE, PA — November 3, 2026 — exida, a global pioneer in industrial automation and control system (IACS) cybersecurity and the world’s first accredited IACS Certification Body (2011), today announced the release of exSILentia® CRA. This new software tool is built directly into the industry-leading exSILentia® platform, and designed to streamline evaluation, reduce time to conformity and help minimize regulatory risk through an optimized threat and risk assessment workflow for manufacturers seeking compliance with the European Union’s Cyber Resilience Act (CRA).
With the enforcement deadline set for December 2027, connected-device manufacturers are scrambling to evaluate tens to thousands of existing and new products. Failure to achieve compliance prior to placing products on the EU market carries a real risk of severe business consequences, including restricted market access, regulatory penalties, and reputational damage.
Under the CRA, manufacturers will need to execute a rigorous, product-level workflow to prove conformity. Central to this process is the Threat Analysis & Risk Assessment – TARA (Product Cybersecurity Risk Assessment). For manufacturers, this step may represent the largest investment of engineering hours, the greatest technical reach for product developers, and the highest compliance risk.
The cybersecurity risk assessment dictates which requirements from the selected harmonized standard or Annex I (essential cyber requirements) apply to a specific product, how those requirements are implemented, and why the chosen mitigations have sufficiently addressed the identified risks based on intended use and operational environment of the product. Every in-scope product must undergo this risk assessment, no matter its category. What is an arduous process for a single product, scales into significant manual effort for companies with large portfolios unless the right tools and workflows are in place.
exSILentia® CRA transforms risk analysis into a structured engineering workflow. Preloaded with an industry standard risk matrix and pre-defined mitigations (requirements) from harmonized standards, the tool ensures product development teams never have to start from scratch.
By embedding the deep domain expertise of exida’s cybersecurity certification assessors— who routinely perform assessments to ISA/IEC 62443 and ISASecure standards—exSILentia® CRA allows product developers to focus on building features rather than navigating complex cybersecurity legislation.
"We want product developers to focus on developing great products, not worrying about becoming cyber legal experts," said Iwan van Beurden, Chief Technology Officer (CTO) at exida. "exSILentia CRA embeds all kinds of cyber risk, certification, and product development subject matter expertise, which is why it is the exact tool we use internally for conducting risk assessments for manufacturers.”
exSILentia® CRA is available immediately as part of the exSILentia® software suite. To learn more about how exSILentia® CRA can streamline your product compliance roadmap, visit www.exida.com/exsilentiacra .
exida is a global pioneer in industrial automation and control system (IACS) cybersecurity. As the world’s first accredited cybersecurity Certification Body (2011) and co-authors of foundational textbooks, our experts shape global standards like ISA/IEC 62443. We are currently pursuing accreditation as an EU Cyber Resilience Act (CRA) Notified Body accreditation. exida helps organizations achieve pragmatic security through consulting, threat modeling, penetration testing, CSMS development, exida Academy courses, and exSILentia® Cyber and CRA software tools. We deliver comprehensive ISA/IEC 62443 certification across processes, components, systems, and personnel to build end-to-end operational resilience for critical infrastructure.
exSILentia CRA is intended to assist manufacturers with CRA-related assessment and documentation. Use of the software does not guarantee compliance with the EU Cyber Resilience Act, constitute or result in certification or conformity assessment, or influence the outcome of any separate certification or conformity-assessment process.