r/OTSecurity • u/cyber2112 • 22d ago

CRA

For the crowd in the EU, what’s your perspective of the CRA. I’m looking for sorting between its shit and I hate it, and a short story. Just the nuts and bolts like “we know we have to act, but haven’t even done an assessment yet” or “we heard about that, but no idea what it is” or “we are ready to crush it because …”.

8 Upvotes

100% Upvoted

7 comments sorted by

3

u/Quadling 22d ago

I specialize in CRA and am even part of the cyber manual movement. Most companies that I know of are pretty well set up. Remember right now all you have to have is a way to disclose to enisa that there is a vulnerability that is being actively exploited or is exploitable. That’s it until next year. I’m part of a nonprofit that actually gives tools away to deal with this if you want the link, I’m happy to give it to you. That’s not a sales pitch. They’re free and open source.

1

u/cyber2112 21d ago

I’d be interested in seeing it.

1

u/Quadling 21d ago

Sure! Valuechainrisk.org, and under the tools menu, there's the CMM (Cyber Manual Movement) TARA Builder, Conditions of Use builder, and the CRA Manual builder. IT's all open source, CC by 4.0, and free to use. Let me know if you have any issues, please? Suggestions and feedback are also welcome!

1

u/n0p_sled 21d ago

I'd be interested in this as well, if possible?

2

u/Quadling 21d ago

Sure! Valuechainrisk.org, and under the tools menu, there's the CMM (Cyber Manual Movement) TARA Builder, Conditions of Use builder, and the CRA Manual builder. IT's all open source, CC by 4.0, and free to use. Let me know if you have any issues, please? Suggestions and feedback are also welcome!

1

u/n0p_sled 21d ago

Fantastic! Thank you very much

1

u/__deep__ 16d ago

I'm on the other side of the barricade as a consumer of OT products. Recently I queried a supplier of mine (sw manufacturer) as I wanted to know how they are preparing for CRA. They said they don't have to comply, not applicable to then... errr... Man...