The main objectives of the EU Cyber Resilience Act include:
• Strengthening full lifecycle security of digital products: Ensuring all products with digital elements have comprehensive cybersecurity protection and vulnerability remediation mechanisms from design through production to after-sales maintenance.
• Enhancing supply chain and digital market resilience: Establishing unified European cybersecurity standards to reduce the risk of systemic cascading cyberattacks triggered by a single hardware or software vulnerability.
• Protecting users' right to information and transparency: Providing clear security guidance and transparent vulnerability reporting mechanisms to help businesses and consumers make informed and safe decisions when purchasing and using digital products.
To give manufacturers sufficient time to adjust and align, the EU Cyber Resilience Act (CRA) adopts a phased rollout strategy. The regulation officially took effect on December 10, 2024, and will be progressively implemented over the following years.
During this transition period, companies must pay particular attention to two key milestones: first, September 11, 2026, when mandatory reporting of security vulnerabilities becomes a legal requirement; and second, December 11, 2027, the "full compliance deadline," by which all products falling within the scope of the CRA must meet the relevant market access requirements. This timeline will affect CE marking and eligibility for sale in the EU market for applicable products.
DFI's secure development process has obtained IEC 62443-4-1 certification, forming the foundation for advancing CRA readiness. We continue to track the progress of harmonized standards from European standardization bodies (CEN/CENELEC/ETSI), strengthening overall resilience through horizontal standards while introducing vertical standards for specific product categories, progressively aligning our product development processes; product security functional specifications are also being planned in accordance with the IEC 62443-4-2 framework.
Per Annex I of the CRA, products with digital elements must meet related horizontal security requirements across two dimensions: first, essential requirements relating to product properties, emphasizing that defense starts at the source — manufacturers must conduct comprehensive risk assessments during the design and production stages, adopt "security by design/secure by default" thinking, and implement corresponding permission and access controls based on risk level; second, essential requirements for vulnerability handling, extending compliance responsibility to the post-sale period — manufacturers must establish vulnerability handling and security update mechanisms during the product's expected period of use, managing known vulnerabilities and reducing lifecycle security risk. Based on this, DFI proposes three cybersecurity focus strategies:
• Security by Design: Integrating SSDLC (Secure Software Development Lifecycle) into industrial motherboard and system development processes, building defense from the hardware Root of Trust upward.
• Deep Embedded Resilience: Partnering with leading chip suppliers to build multi-layered defenses from BIOS and firmware to the OS level, reducing exposure to complex threats.
• Full Lifecycle Vulnerability Management: Establishing a PSIRT and vulnerability management process to support vulnerability management and security updates throughout the long operational life of industrial-grade equipment, improving resilience against emerging threats.
Committed to the philosophy of "security by design." We conduct ongoing cybersecurity risk assessments, rigorous supply chain due diligence, and provide secure update mechanisms to ensure long-term sustainable support.
• Continuous Assessment: Cybersecurity risk assessments are conducted and records maintained throughout the product's planning, design, production, and maintenance phases.
• Supply Chain Security: Rigorous due diligence is performed when integrating third-party and open-source components to guard against security risks.
• Continued Support: We have established secure update mechanisms to provide security updates based on risk level and verification results within the specified support period.
We maintain a dedicated Product Security Incident Response Team (PSIRT), operating with reference to the ISO 29147 and ISO 30111 practice guidelines, and adopting the FIRST services framework for coordinated response, ensuring reliable vulnerability disclosure and handling.
• Global Framework: Our PSIRT operates in line with the best practices of ISO 29147 (vulnerability disclosure) and ISO 30111 (vulnerability handling), consistent with the reference frameworks adopted by the CRA.
• Coordinated Response: We have adopted the FIRST services framework to reliably handle reported security vulnerabilities and issue security advisories.
• Long-Term Commitment: Our processes provide ongoing support for industrial equipment expected to operate securely over long lifecycles.
We maintain the necessary technical documentation and audit records, provide users with clear product transparency information (such as end-of-support dates and vulnerability contact points), and equip products with authentication and patch deployment tools.
• User Transparency: We provide clear product information, including intended use, end-of-support dates, and vulnerability reporting contact details.
• Built-in Defense Mechanisms: Products feature tiered authentication and access control designs, support secure default configurations, and provide reliable mechanisms for deploying security updates and patches.
DFI is committed to rigorous management of product security vulnerabilities, providing customers with reliable guidance and mitigation methods for product information security vulnerabilities, in order to minimize related risks. To this end, DFI PSIRT is responsible for handling product information security incidents reported to DFI and related vulnerability notifications. DFI continues to reference internationally and industry-recognized practices and standards, continually strengthening its vulnerability handling procedures and response measures, and taking a proactive approach to supporting industrial cybersecurity as a trusted partner to our customers.
• Product Security Vulnerability Management Process: DFI's product security vulnerability management process consists of five stages, each with a rigorous handling procedure. For updates and publication of product security advisories, please refer to the CRA "Security Advisories" section.
• Product Security Contact: If you discover a suspected security vulnerability in any DFI product, please report it through the DFI PSIRT contact: PSIRT@dfi.com. For DFI, timely discovery of security vulnerabilities is key to reducing potential product security risks.
Aspects of the information security vulnerability management principles may be subject to change on a case-by-case basis. DFI will evaluate and handle reports based on their content, scope of impact, and risk level; handling methods and timelines may vary by case. Use of the information contained in this document, or content linked from this document, is at your own risk. DFI reserves the right to modify any content within this policy at any time without prior notice. Any revisions will be published on the CRA-related information page of the official DFI website.
Should a security concern be identified, DFI will follow relevant CRA requirements to issue security advisories and complete corresponding notifications, while providing security update guidance for customers to download and use to resolve related issues. Please see the download section on the right for related files.
