CRA, RED 3.3 and the Machinery Regulation are converging on you.
You build products, machines or components with digital elements. RED 3.3 applies since August 2025, CRA reporting duties start 11 September 2026, the Machinery Regulation follows in January 2027, and full CRA obligations land 11 December 2027. IEC 62443-4-1 and 4-2 are the industrial route through: one body of evidence that serves the laws and the RFPs.
The situation, named
The parts that apply to you
What you run in OTRISK
Your lifecycle, evidenced once. Assess development practice against 4-1 with owners, deadlines and independent review: living evidence you point three regulations at.
Component capabilities at a target. Run 4-2 per product family at the security level your market asks for; the RFP answer becomes a lookup.
Answer your customers where they assess. When an asset owner runs OTRISK, you evidence 4-1/4-2 inside their environment, once per customer instead of once per spreadsheet.
Honest scope: OTRISK organises and proves your conformance work; it doesn't test products or issue certificates. Certification stays with the labs. You arrive prepared.
One body of evidence. Three regulations served.
Thirty minutes with an OT security expert. Bring one product family in mind: we show you which parts of OTRISK fit your situation and how the way of working looks. You leave with concrete next steps and pricing.