This talk will demonstrate how risk analyses, security requirements engineering, system architecture design, hardening, test automation, monitoring and vulnerability management are interlinked. The presentation will show how a structured approach based on IEC 62443 covers both regulations and where NIS 2 and the CRA go beyond existing standards.

• NIS 2 vs. CRA: Who has to do what – operators, manufacturers, integrators?

• Delta analysis: What covers ISO 27001 / IEC 62443

• From security concept to decommissioning: What needs to happen in which lifecycle phase

• Notification, supply chain responsibility and declarations of conformity – the new obligations

• Shared Security Services: PKI, SOC, IAM

• Why test automation and vulnerability management are now becoming mandatory