Author: NetStaX Engineering Team
If you are developing industrial devices that connect to EtherNet/IP networks and you intend to sell them in the European Union, the EU Cyber Resilience Act (CRA) is now a hard requirement on your roadmap — not a future discussion. With the full compliance deadline of December 11, 2027, and an earlier vulnerability-reporting obligation kicking in on September 11, 2026, manufacturers need to act now.
The good news: if you build on Pyramid Solutions’ NetStaX EtherNet/IP stack with the SECURE package (EADK-SECURE or ESDK-SECURE) and follow ODVA’s published guidance, you have the core technical building blocks to demonstrate CRA compliance and continue selling your product in Europe.
The Bottom Line: Using CIP Security with our NetStaX Secure stacks, combined with ODVA’s CRA guidance, puts your EtherNet/IP device on the most straightforward path to EU market access after 2027.
What Is the EU Cyber Resilience Act?
The CRA mandates cybersecurity requirements for all “products with digital elements” — hardware or software that processes digital data and connects to other systems. That scope is deliberately broad: industrial PLCs, I/O modules, drives, sensors, and any embedded device with a network interface all fall within it.
The regulation imposes two categories of obligations on manufacturers:
- Product Cybersecurity Requirements —a set of functional security properties a product must possess, including secure-by-default configuration, protection against unauthorized access, encrypted data transmission, and data integrity. The CRA specifies 13 such requirements in Annex I, but as ODVA notes, most apply to product design decisions that fall outside the scope of CIP technologies. Four of those 13 are directly addressed by CIP Security — those are covered in detail below.
- Vulnerability Management Requirements — a structured process for identifying, disclosing, and remediating vulnerabilities throughout the product’s supported life, including a Software Bill of Materials (SBOM) and a responsible disclosure channel.
Manufacturers must also maintain Technical Documentation demonstrating compliance and End-User Documentationcovering secure installation, configuration, and maintenance — and they must apply the CE mark to signify conformity.
For most EtherNet/IP products, ODVA notes that manufacturers can conduct their own conformity assessment and apply the CE mark independently. Only products classified as “Important Class I/II” or “Critical” require third-party evaluation.
Key CRA Dates
September 11, 2026: Manufacturers must have a vulnerability reporting and disclosure process in place for all digital products sold in the EU.
December 11, 2027: Full CRA compliance is required for every digital product available in the EU market — including existing products, not just new ones.
How CIP Security Addresses the Four Relevant CRA Requirements
ODVA’s Technology Overview (PUB00356R0, “CIP Security: A Valuable Tool for CRA Compliance”) identifies exactly four of the CRA’s Annex I product requirements that are directly influenced by CIP Security. The remaining nine requirements apply to product design decisions — documentation, threat modeling, supply chain management — that are the manufacturer’s responsibility regardless of which protocol stack they use.
Here are the four CIP Security-relevant requirements, and how the NetStaX SECURE packages address them:
Annex I, 2b
Secure by Default
CIP Security requires that non-TLS/DTLS ports be disabled by default. End users may re-enable non-secure EtherNet/IP ports based on their own risk assessment using the TCP/IP Interface Object. Port 44818/UDP (ListIdentity/discovery) may remain open.
Annex I, 2d
Protection Against Unauthorized Access
The EtherNet/IP Confidentiality Profile supports authentication via both X.509 certificates and pre-shared keys (PSK), using mutual TLS. Only authenticated peers can establish a session with the device.
Annex I, 2e
Confidentiality of Transmitted Data
All EtherNet/IP traffic is encrypted using TLS (TCP) and DTLS (UDP/I/O) with AES — a globally accepted encryption standard. Cipher suites are configurable to match your security policy.
Annex I, 2f
Integrity of Transmitted Data
All CIP Security cipher suites enforce message integrity via SHA-based HMACs. Digital certificates used in the handshake are further protected by digital signatures, ensuring configuration and commands cannot be silently altered.
Important Scope Note: CIP Security secures data in transit. Protection for data at rest and the broader secure development lifecycle — documentation, SBOM, threat modeling, and secure development practices per IEC 62443-4-1 or NIST 800-218 — remain the device manufacturer’s responsibility. Contact our team to discuss how these fit into your CRA readiness plan.
Vulnerability Management: The Other Half of CRA
Technical product security is only one side of CRA compliance. The regulation also requires that manufacturers have a formal, ongoing vulnerability management process. For Pyramid Solutions products, that process works as follows:
Disclosure Channel
Vulnerability reports for Pyramid Solutions EtherNet/IP stacks are handled through CERT/CC VINCE(kb.cert.org/vince). CERT/CC coordinates disclosure across all affected parties and works with CISA ICS-CERT to publish the resulting ICS Advisory. The public record of advisories appears on cisa.gov under the ICSA-xx-xxx-xxformat. A direct submission link for reporting vulnerabilities to Pyramid Solutions will be published on our website — check pyramidsolutions.com for the current link.
Remediation Policy
Security fixes are delivered in the latest release of the NetStaX stack. Customers on an active update/maintenance agreement — within 12 months of purchase, or with a current update subscription — receive updated releases as they are published.
What This Means for Your CRA Obligations
As the device manufacturer, you are responsible for your own vulnerability management process covering your product as a whole. Pyramid Solutions’ process covers the stack component. When a vulnerability is found in the underlying NetStaX stack, Pyramid Solutions will issue an advisory and a fix in the latest release. You then carry the obligation to integrate that fix into your product and deliver it to your end customers. Your documentation must describe this chain to satisfy the CRA’s disclosure and update requirements.
The NetStaX SECURE Packages: Your CRA Technical Foundation
Pyramid Solutions offers two CIP Security-enabled developer kits for EtherNet/IP products:
- EADK-SECURE — CIP Security extension for the EtherNet/IP Adapter Development Kit (EADK). Adds TLS/DTLS transport security, X.509 certificate management, configurable cipher suites, and PSK support to adapter-class devices.
- ESDK-SECURE — CIP Security extension for the EtherNet/IP Scanner Development Kit (ESDK). Provides the same transport security capabilities for scanner/originator-class devices, including outgoing TLS/DTLS session management.
Both packages implement the EtherNet/IP Confidentiality Profile — the CIP Security profile that directly addresses the four CRA requirements above. The current production release is version 5.6.0.
When vulnerabilities are published in public databases, Pyramid Solutions products are identified following the naming convention established in CISA ICS Advisory ICSA-22-174-04: “Pyramid Solutions EtherNet/IP Adapter Development Kit” and “Pyramid Solutions EtherNet/IP Scanner Development Kit”, listing the applicable stack versions under Affected Products.
A Practical Scenario
Consider a device manufacturer using the EADK to build an EtherNet/IP I/O module that will be sold in Europe. Under the CRA:
- The device manufacturer is the “manufacturer” under CRA — they bear responsibility for CE marking, documentation, and vulnerability management for their finished product.
- Adding EADK-SECURE provides the protocol-level security (TLS/DTLS, mutual authentication, AES encryption) that addresses the four CIP Security-relevant CRA requirements.
- The manufacturer must independently establish a vulnerability disclosure channel, maintain an SBOM, produce compliant technical documentation, and follow a recognized secure development framework.
- If a vulnerability is found in the underlying NetStaX stack, Pyramid Solutions will coordinate disclosure through CERT/CC VINCE and publish a fix in the latest release. The device manufacturer is then responsible for integrating that fix and delivering an update to their end customers.
It is also worth noting: using a non-secure stack variant to build a product for sale in Europe is a CRA risk from the outset — not because the stack has a known vulnerability, but because lacking encrypted, authenticated communications fails the CRA’s product cybersecurity requirements at the design level. EADK-SECURE addresses that risk directly.
Next Steps for Your CRA Readiness
If you are using a Pyramid Solutions EtherNet/IP developer kit and plan to sell in the EU, here is where to start:
- Upgrade to EADK-SECURE or ESDK-SECURE if you are not already on the SECURE package. This is the prerequisite for CRA-compliant EtherNet/IP communications. Migration to EADK-SECURE or ESDK-SECURE is straightforward. The SECURE stack is a drop-in replacement for the corresponding standard stack (EADK or ESDK), retaining the existing APIs and application architecture while adding the APIs required to support CIP Security functionality.
- Review ODVA PUB00356R0 — “CIP Security: A Valuable Tool for CRA Compliance” — for the authoritative mapping of CIP Security to CRA Annex I requirements.
- Establish your own vulnerability disclosure process before the September 2026 deadline. Your product documentation must point customers to your reporting channel.
- Build your SBOM and start your technical documentation now — waiting until late 2027 leaves no time to address gaps identified during review.
- Contact Pyramid Solutions to discuss your architecture, support period commitments, and how your product should be identified in vulnerability databases.
Ready to start your CRA compliance journey? Talk to our engineering team about EADK-SECURE, ESDK-SECURE, and CRA readiness for your EtherNet/IP product.
> Learn More on our NetStaX Product Page
References & Further Reading
- ODVA PUB00356R0 — CIP Security: A Valuable Tool for CRA Compliance
odva.org - ODVA — EU Cyber Resilience Act Compliance in Industrial Automation
odva.org/library_proceedings - CISA ICS Advisory ICSA-22-174-04 — Pyramid Solutions EtherNet/IP Adapter Development Kit
cisa.gov - CERT/CC VINCE — Vulnerability reporting portal
kb.cert.org/vince - ODVA Conformance Testing — odva.org/technology-standards/conformance-testing
CIP, CIP Security, and EtherNet/IP are trademarks of ODVA, Inc.
