Cyber Resilience Act and SoM Selection: How Variscite supports project security

2026-09-02

With the Cyber Resilience Act (CRA), cybersecurity is becoming a mandatory element in the design of devices with digital components. The requirements now apply not only to the product itself, but also to how it is updated, maintained, and how vulnerabilities are handled. Therefore, when selecting a SoM today, it is worth considering not only performance or available interfaces, but also Secure Boot, updates, SBOM, vulnerability management, and manufacturer support. Using Variscite as an example, we show how such requirements can already be addressed at the platform level.

What does the CRA mean for a device manufacturer?

The Cyber Resilience Act covers hardware and software products with digital elements made available on the European Union market. It introduces cybersecurity requirements throughout the successive stages of a product's lifecycle, from planning and design to production, maintenance, and vulnerability handling.

The CRA entered into force on December 10, 2024, but its requirements are being implemented in stages:

from September 11, 2026, requirements concerning the reporting of actively exploited vulnerabilities and serious incidents apply,
from December 11, 2027, the main requirements of the regulation will apply.

Manufacturers therefore need to look beyond whether a device is secure at the time it is placed on the market. The ability to update software, manage identified vulnerabilities, maintain security documentation, and support the product throughout its support period also become important. In practice, this means that the choice of processor, System-on-Module, or operating system has not only technical consequences, but also affects how product security is managed later on.

The hardware platform is part of the security strategy

In an embedded device, security mechanisms are distributed between hardware and software. Important factors may include the way the system boots, how cryptographic keys are stored, software updates, and the ability to identify the software components being used. Therefore, when selecting a platform intended to meet CRA requirements, it is worth checking:

whether the platform supports Secure Boot,
how keys and other sensitive data can be protected,
whether TPM (Trusted Platform Module) or other trusted storage mechanisms are available,
how updates can be delivered to devices already deployed at customer sites,
whether the manufacturer supports SBOM generation,
how the platform software is maintained and updated.

These are areas that Variscite is developing within its System-on-Module ecosystem in the context of preparing products for the requirements of the Cyber Resilience Act.

Are Variscite modules compliant with the CRA?

Variscite provides solutions that can be used when building a device designed to meet CRA requirements. These include, among other things, SBOM generation, software and OTA update mechanisms, Secure Boot, TPM or other methods of secure key storage, as well as data encryption. The availability of individual features depends on the selected SoM and the software stack being used.

Particularly important is the SBOM, or Software Bill of Materials, which contains a list of software components used in the product. Such information becomes crucial when a new vulnerability is discovered. The manufacturer can quickly determine whether the affected component or library is present in the device and whether action is required.

The same applies to updates. The manufacturer needs a way to deliver a fix to devices that may already be deployed at customer sites. Therefore, the ability to plan an update mechanism, including OTA updates, should be taken into account while designing the product architecture.

TPM and Secure Boot on Variscite platforms

A specific example of a platform developed with modern security requirements in mind is the VAR-SMARC-MX8M-PLUS based on the NXP i.MX 8M Plus processor.

The module can use a hardware TPM 2.0, while the processor platform itself provides, among other things, Secure Boot mechanisms and hardware cryptographic functions. Variscite identifies these solutions as elements supporting the design of systems with CRA requirements in mind:

TPM can be used, among other things, for secure storage of cryptographic keys or for performing operations related to device authentication.
Secure Boot, on the other hand, makes it possible to control whether trusted software is launched when the device starts up.

For a designer using a System-on-Module, it is important that some of the security mechanisms are already tied to the selected platform. This means that not every issue has to be solved from scratch on a custom carrier board.

CRA-ready does not automatically mean compliance of the final product

Variscite emphasizes that the reference software images provided by the manufacturer are a starting point for further development, not a ready-made production system that meets all the requirements of the final device. The device manufacturer must adapt the software to its application, enable the required security mechanisms, remove unnecessary components, verify the configuration, and subsequently maintain the product. Responsibility for risk analysis, device configuration, the update process, vulnerability handling, and the final conformity assessment therefore remains with the manufacturer of the end product.

Why is it worth checking CRA requirements when selecting a SoM?

If security is considered only after the PCB has been completed and the application has been brought up, some changes may require going back to earlier stages of the project.

For example, it may turn out that an additional component is required for secure key storage, the device boot process needs to be changed, an update mechanism must be prepared, or a different approach to software maintenance is needed. That is why security and CRA requirements should be considered alongside performance, interfaces, power consumption, and lifecycle when selecting a platform. At Soyter, we can help select a Variscite solution not only in terms of hardware specifications, but also with regard to available security mechanisms, operating system, software support, and the planned product lifecycle.

Are you designing an embedded device for the EU market? Let's talk about Variscite platforms and the security requirements worth considering from the very beginning of the project.

Show more entries from September 2026