The attached Security Bulletin represents our aligned and official communication regarding the European Cyber Resilience Act (CRA).

For new Digital products, as outlined in the bulletin, we are targeting compliance of our development process with IEC 62443 4 1 within this 2026. This is a prerequisite for achieving IEC 62443 4 2 product certifications.

In parallel with our efforts to certify the main platforms against IEC 62443 4 2, legacy platforms can also be deployed in a CRA compliant (and Marine-) configuration. For product specific guidance, please refer to Woodward Application Note 51654 – Legacy Products System Security Practices (Link here), as well as the corresponding Product Security Manuals for each individual product.

Because cybersecurity is defined at — and originates from — the system level, these same requirements also apply to our system integrators. This includes Marine regulations, E26 and E27, which can be considered equivalent to IEC 62443.

Please find Cyber Security Manuals here:
https://www.woodward.com/support/industrial-service-and-support/cybersecurity-support-portal/