Industrial cybersecurity · Netherlands & Cyprus
Cyber Resilience Act readiness for machine builders
GCG maps where your product stands, what is missing and what needs to change, and turns that into an actionable improvement plan. Our engineers can also implement the agreed changes to controls, networks and software.
Assessment and implementation services
CRA Readiness Assessment
An evidence-based starting point: review the product inventory, existing documentation and available security evidence. Distinguish what is demonstrated, missing or requires further investigation.
Product classification & scope
Establish the product boundary, digital elements and supply-chain role. Applicability and exclusions require product-specific assessment.
Secure Development Review
Connect risk assessment to software development: source control, code review, security testing and release criteria. Review how technical changes are documented and controlled.
SBOM & component management
Build visibility into software components and dependencies, CycloneDX/SPDX readiness and vulnerability traceability.
Vulnerability Management / PSIRT
Establish monitoring, triage, response and ownership. Include coordinated vulnerability disclosure (CVD), reporting routes and a workable update and support policy.
Supplier cybersecurity
Assess critical suppliers and components for available security information, maintenance, updates and dependencies. Translate findings into agreements and risk treatment.
OT Security Review
Review PLC/HMI, industrial PCs, networks, remote access, backup, logging and segmentation within the agreed scope. Active testing on production equipment requires explicit coordination and approval.
IEC 62443 gap assessment
Where relevant, assess zones and conduits, security objectives and gaps against applicable parts of IEC 62443. A gap assessment is not a certificate or a declaration that a security level has been achieved.
Roadmap & implementation
Consolidate findings into a risk register, management report and phased improvement plan: immediate, medium-term and structural. GCG can also design, program and implement the agreed technical measures.
Re-assessment
After changes, collect fresh evidence, verify measures and record residual risks. Documentation, handover and training support ongoing management.
Readiness, not certification
GCG is not a notified body, certification body or legal adviser. An assessment provides insight into scope, evidence and gaps. It does not issue a CRA certificate or guarantee conformity. Formal conformity assessment and statutory responsibility remain separate matters.
Engineers who work on this
Jurn OvermarsFounder (CEO): Software & ITMore about Jurn
Raymond Consen-TumpCo-Owner: Senior Automation EngineerMore about Raymond
Nick SchokkerAutomation & Embedded Systems EngineerMore about Nick
One connected pathway
From evidence to improvement.
Discover
Intake, product boundaries, roles and evidence request.
Assess
Examine product, supplier and OT risks.
Verify
Check documentation and statements against available evidence.
Prioritize
Bring risks, ownership and the improvement roadmap together.
Implement
Carry out agreed technical and organizational improvements.
Re-assess
Reassess progress and residual risks.
The scope determines which elements are needed. Interviews, document review and technical verification feed into traceable findings.
Assess and deliver the technical changes.
Our automation and software engineers can translate findings into design, modification, programming, implementation, commissioning, documentation and training. From PLC/HMI and industrial networks to servers, identity, logging and cloud connections.
OT measures must account for machine safety, availability and production shutdowns. OPC UA/MQTT connections, remote access, patching and recovery procedures are assessed in the context of the complete system.
Related frameworks, distinct responsibilities.
| Framework | Focus |
|---|---|
| CRA (opens in a new tab) | Cybersecurity of products with digital elements and responsibilities of economic operators. |
| IEC 62443 (opens in a new tab) | Industrial cybersecurity standards covering systems, components and processes. Applicable parts and objectives define the assessment. |
| NIS2 (opens in a new tab) | Organizational security and reporting obligations for in-scope entities, through national implementation. |
| Machinery Regulation (opens in a new tab) | Machinery safety, including protection of safety-relevant software and data against corruption. |
One technical measure may support multiple objectives. That does not make the frameworks interchangeable: an IEC 62443 assessment does not replace CRA conformity assessment.
CRA and NIS2: separate reporting paths
CRA reporting concerns actively exploited vulnerabilities and severe security incidents affecting products with digital elements, via the CRA Single Reporting Platform to the designated CSIRT and ENISA. NIS2 concerns significant incidents at in-scope entities and the applicable national reporting channel. Assess both triggers separately. One report does not automatically fulfil both obligations.
European Commission: CRA reporting (opens in a new tab) NIS2 (opens in a new tab)
CRA reporting obligations apply from 11 September 2026. The main remaining obligations apply from 11 December 2027. Check scheduling and product scope against current official guidance. Source: European Commission (opens in a new tab).
What needs to change in your installation?
Tell us what is already installed and what you are running into.