Building cybersecurity into industrial HMI products
Cybersecurity is now an integral part of industrial product development.
Connected HMIs, controllers and other electronic components increasingly exchange data with machines, networks and external systems. At the same time, regulations such as the EU Cyber Resilience Act (CRA) are introducing new cybersecurity requirements for products containing digital elements.
For equipment manufacturers, cybersecurity needs to be addressed throughout the product lifecycle, from architecture and design to maintenance and vulnerability management.
APEM is developing its cybersecurity processes and expertise accordingly, with the objective of supporting OEMs and system integrators as these requirements evolve.
Cybersecurity throughout the product lifecycle
Effective product cybersecurity requires more than adding individual security functions.
Security considerations need to be incorporated into the engineering process itself: identifying potential threats, defining appropriate design requirements, verifying their implementation and maintaining products after they enter service.
APEM is structuring its approach around these principles, including:
threat analysis and cybersecurity risk assessment;
secure product development and design rules;
verification and documented evidence;
technical documentation;
vulnerability management;
security corrections and software updates;
preparation for product conformity assessments.
This lifecycle approach is particularly important for products incorporating software, where new vulnerabilities or security requirements may emerge long after the initial development phase.
APEM plans to maintain product compliance throughout the declared support period through corrections, security patches and software upgrades, using controlled release mechanisms agreed with customers.
Preparing for the Cyber Resilience Act
The European Cyber Resilience Act introduces cybersecurity obligations for manufacturers of products with digital elements. Industrial players will need to be fully prepared by 11 December 2027, when the CRA becomes fully applicable.
For component manufacturers, this means progressively integrating security requirements into product development, documentation, maintenance and vulnerability management.
APEM is currently accelerating the assessment of its existing product portfolio against CRA requirements and developing a structured evaluation framework for future products.
The objective is not simply to respond to one regulation. It is to establish secure product development processes capable of supporting future European requirements, including both the CRA and the Machinery Regulation.
For OEMs integrating APEM industrial HMIs into larger systems, this approach can also help provide the technical information and product-level evidence required when preparing their own compliance activities.
A structured development process based on IEC 62443
A major step in this strategy is APEM's implementation of IEC 62443-4-1, an international cybersecurity standard for organizations developing products used in industrial automation and control systems.
The standard establishes cybersecurity practices covering the entire secure development lifecycle, from initial requirements and product design through verification, maintenance and eventual retirement.
APEM has received confirmation from Bureau Veritas LCIE that its IEC 62443-4-1 Maturity Level 2 assessment has been successfully validated.
The next step is to extend this approach towards product-level cybersecurity, including the certification process for APEM's embedded product reference architecture.
Managing vulnerabilities with a dedicated PSIRT
Cybersecurity responsibilities continue after a product reaches the market.
APEM has therefore established a Product Security Incident Response Team (PSIRT) responsible for managing reported vulnerabilities.
The PSIRT provides a structured process to:
receive vulnerability reports;
assess their severity and potential impact;
coordinate corrective actions;
manage communication concerning identified vulnerabilities.
This organisation creates a defined channel between customers, cybersecurity specialists and APEM's engineering teams when a potential security issue is identified.
Dedicated cybersecurity expertise within APEM
To support these developments, APEM has established a Functional Safety and Cybersecurity Competence Center in France.
Its role is to develop expertise, processes and reusable engineering methods that can be applied across different APEM and IDEC activities.
The competence centre is already contributing to secure product development and certification work for projects including joysticks, APEM Panel Solutions and IDEC Mobility Solutions, with additional projects planned.
The objective is also to increase the reuse of cybersecurity architectures, methodologies and tools across the Group rather than developing isolated approaches for every product. This can help improve consistency while making compliance activities more efficient.
PSIRT : supporting OEMs beyond the component
If you identify a potential vulnerability in an APEM product, or experience a cybersecurity incident involving one of our products, please report it through this form.
Get the help and resources you need quickly with APEM
If you have questions or suggestions, we’re here to listen.
Our sales and support set the standard for helping you.
All the technical documentation you need to make things work...