ZIUR focuses on cybersecurity in the industrial supply chain
ZIUR held a webinar on supply chain security for industrial products in collaboration with Govertis-Telefónica Tech, as part of the initiatives the center is carrying out to help industrial companies adapt to the Cyber Resilience Act (CRA).
The session addressed the risks associated with outsourcing services and dependence on suppliers, as well as the measures organisations can adopt to properly identify, assess and manage these risks throughout the product lifecycle.
Govertis-Telefónica Tech experts Ekaitz García Lizarza and José Antonio Sánchez Durán analysed the impact of the CRA on the supply chain and the responsibilities it introduces for companies. During the webinar, they presented the main types of attacks that can occur through suppliers and shared criteria for supplier selection and approval, covering hardware, firmware, chips, software and third-party services.
Another key topic addressed during the session was the management of the Software Bill of Materials (SBOM) and vulnerabilities affecting components and suppliers. In this regard, the webinar highlighted the need to monitor these elements throughout their lifecycle and to maintain the necessary evidence to demonstrate security and regulatory compliance.
The webinar also covered aspects related to business continuity, such as identifying alternative sources of supply and preparing for potential incidents involving suppliers. It also addressed issues related to conformity assessment, technical documentation and CE marking under the CRA.
The practical part of the session included an analysis of the risks associated with suppliers, integrators, components, software, firmware, libraries and external services, as well as a case study involving a compromised supplier. This exercise provided an opportunity to address prevention, detection and response measures, as well as the responsibilities of the different actors throughout the product lifecycle.
Supporting companies in adapting to the CRA
This activity forms part of the ZIUR Acceleration Program, a strategic initiative aimed at supporting industrial companies in Gipuzkoa in their adaptation to the new European cybersecurity framework.
The Cyber Resilience Act establishes new cybersecurity requirements for products with digital elements placed on the European Union market and represents a significant change for companies that design, develop and market these types of products. In this context, ZIUR is developing a range of awareness-raising, training and support initiatives to help companies understand and implement the new requirements.
One of the regulation's first milestones is the requirement to have mechanisms in place for vulnerability reporting, which started to apply on 11 September 2026. Compliance with these new requirements requires companies to review their processes and capabilities in areas such as vulnerability management, supply chain security and product cybersecurity.
Through initiatives such as this webinar, ZIUR continues to provide companies with knowledge and practical tools to support their adaptation to the CRA and strengthen the cybersecurity of their products and supply chains.