APEM reaches IEC 62443-4-1 Maturity Level 2

Content

• APEM reaches IEC 62443-4-1 Maturity Level 2

• What is IEC 62443-4-1?

• What does Maturity Level 2 mean?

• Why APEM selected IEC 62443-4-1

• From process certification to secure products

• IEC 62443-4-1 and the Cyber Resilience Act

• Cybersecurity, who is responsible?

• PSIRT: vulnerability management after product release

• Building cybersecurity expertise across APEM and IDEC

• Vulnerability and cybersecurity incident reporting form

APEM has reached an important milestone in its product cybersecurity programm: Bureau Veritas LCIE has successfully validated APEM's IEC 62443-4-1 Maturity Level 2 assessment.

The standard establishes secure product development requirements for organizations creating components and solutions used in industrial automation and control systems.

For APEM, adopting IEC 62443-4-1 creates a structured cybersecurity framework that can be applied throughout product development and maintenance, while also preparing the company and its customers for increasingly demanding cybersecurity regulations.

Secure development lifecycle stages:

• cybersecurity requirements;

• secure product architecture and design;

• implementation;

• security verification and validation;

• vulnerability management;

• product maintenance;

• eventual product retirement.

APEM and IDEC selected IEC 62443-4-1 as the foundation for their product cybersecurity development approach because it provides a recognized framework that also supports preparation for European regulatory requirements.

In particular, the methodology helps structure activities relevant to:

• the Cyber Resilience Act (CRA);

• the EU Machinery Regulation;

• cybersecurity risk analysis;

• technical documentation;

• conformity assessment preparation.

IEC 62443-4-1 primarily addresses the manufacturer's development process.

This distinction is important.

Certification of the development organisation does not automatically mean that every product is individually IEC 62443-certified. Instead, it establishes the secure development framework under which products can subsequently be designed, assessed and maintained. APEM's next cybersecurity milestone is the deployment of certified cybersecurity reference architectures across its embedded product portfolio. Designed as ready-to-use foundations for future developments, these architectures enable customers to accelerate innovation while addressing cybersecurity compliance from the very beginning of their projects, transforming compliance from a constraint into a competitive advantage.

For customers, this approach provides greater visibility into how cybersecurity is managed before, during and after product development.

Cybersecurity and compliance responsibilities vary depending on how an APEM product is supplied and integrated. Whether APEM provides a component, markets a standalone product or develops a customer-specific solution determines how responsibilities are shared between APEM and the OEM, particularly under the Cyber Resilience Act and Machinery Regulation.

Secure product development does not stop when a product leaves the factory. New vulnerabilities can be identified during operation, requiring manufacturers to evaluate their impact and determine whether corrective measures are necessary.

APEM has therefore established a Product Security Incident Response Team (PSIRT).

The team manages vulnerability reports, assesses their severity and coordinates both corrective actions and associated communication.

IEC 62443-4-1 is also part of a broader effort to develop cybersecurity expertise within the Group.

APEM has created a Functional Safety and Cybersecurity Competence Center in France to support product teams with methodology, development and certification activities.

For OEMs and system integrators, this means that IEC 62443-4-1 is not being treated as an isolated certification exercise. It forms part of a broader programm designed to integrate cybersecurity into APEM's engineering processes, product architectures and lifecycle support.

If you identify a potential vulnerability in an APEM product, or experience a cybersecurity incident involving one of our products, please report it through this form.