Michelle Michael

It's not easy to summarise, because my job is very complex. First and foremost, I work as a Project Lead in Industrial Security. At the same time, I have leading roles in various committees. I drive the topics forward, define procedures and bring the results to TÜVIT.

So you could say that as an expert, I am responsible for test procedures and standards.

According to the Cyber Resilience Act (CRA), all products with digital elements that are directly or indirectly connected to another device or network fall within its scope. Manufacturers must prove that their products are developed on a risk-based basis according to "security by design" and "security by default", are placed on the market without known exploitable vulnerabilities and are secured throughout the entire support/life cycle with security updates, vulnerability handling and transparent documentation.

From 11 December 2027, products with digital elements may only be placed on the EU market for the first time if they meet the CRA requirements and are properly CE marked.

We support manufacturers end-to-end on the path to CRA conformity: from scope/product classification, threat & risk analyses (TARA), gap analyses and SDLC maturity level development to auditable technical documentation and preparation of the conformity assessment. As TÜVIT, we bring the typical combination of independence, testing methodology and industry expertise (including OT/ICS) to the table and can systematically dovetail the requirements with established standards and best practices.

It is important to me to establish TÜVIT as a frontrunner - in other words, that we lead the way with our expertise. I enjoy this because I have different perspectives: on the manufacturers, on the operators, on other certification bodies and on testing laboratories.

Quite clearly: the Cyber Resilience Act. This is a very important topic that will occupy me and many others in the future. And that's a good thing because the CRA is relevant for manufacturers. Overall, cyber security is more in focus than ever when you look at the current security situation. It affects us all.