The landscape of IoT security is undergoing a fundamental shift. For years, the focus remained on securing the devices themselves and the applications they ran. Now, the European Union’s Cyber Resilience Act (CRA) is forcing a re-evaluation, demanding security be built-in from the very beginning of the manufacturing process – and thoroughly documented.
This new regulation presents a critical question for companies building connected products: how much of this crucial security groundwork can be confidently inherited from their component suppliers? The CRA isn’t simply about *having* security measures; it’s about demonstrably proving their existence and effectiveness to regulators through detailed technical documentation and verifiable evidence.
One company, Quectel Wireless Solutions, is proactively addressing this challenge. They’ve established a comprehensive cybersecurity program designed to align with the CRA’s requirements, well ahead of the 2026 deadline. This isn’t a single new feature, but a fundamental change in process and a commitment to providing the necessary proof of security.
Central to Quectel’s approach is a long-standing collaboration with Finite State, a specialist in connected device and software supply chain security. This partnership focuses on transparency and regulatory alignment, ensuring customers integrating Quectel modules into products for the European market have the documentation they need.
The deliverables are centered around detailed documentation and rigorous testing. Quectel modules are now delivered “pre-tested and audit-ready,” accompanied by crucial security documentation like Software Bills of Materials (SBOMs) and Vulnerability Exploitability Exchange (VEX) files, alongside comprehensive vulnerability reporting.
This collaboration is built on three key pillars: independent security testing to validate robustness, complete software supply chain visibility to understand component origins, and continuous risk management with ongoing monitoring and remediation processes. This proactive approach aims to identify and address vulnerabilities before they can be exploited.
The CRA places significant emphasis on a product’s entire lifecycle. Manufacturers must ensure security isn’t a one-time fix, but a continuous process of updates and vulnerability management. This is particularly challenging for industrial deployments where devices remain operational for years, requiring ongoing software support and adaptation to evolving threats.
For IoT manufacturers and integrators, a “CRA-aligned” module program offers substantial value by reducing the burden of mapping software components and assessing vulnerabilities. However, it also introduces new operational demands. Teams must establish processes to ingest supplier documentation, correlate it with their own systems, and produce traceable evidence for audits.
Connectivity hardware, like cellular or Wi-Fi modules, represents a particularly sensitive point in the device stack. These modules aren’t just radios; they contain firmware and a complex software supply chain that directly impacts overall security. Increasingly, security evidence is becoming a key factor in module selection, alongside traditional considerations like performance and cost.
The implications extend beyond initial deployment. The CRA’s focus on vulnerability handling necessitates tighter integration between device management, update delivery, and security monitoring. Suppliers who can provide structured reporting and component transparency will be invaluable partners in responding quickly to emerging threats.
Quectel’s message is clear: the CRA will reshape the entire embedded ecosystem, and they aim to provide modules accompanied by the documentation and validation needed to meet regulatory scrutiny. As the 2026 deadline approaches, expect more module manufacturers to follow suit. The true differentiator will be the usability of this evidence and the long-term commitment to security throughout a device’s lifecycle.
