EtherCAT, AB Cyber Resilience Act Requirements Met

[Cengiz Özemli]

​

The EtherCAT Technology Group (ETG) has announced that the EtherCAT protocol meets the Security Level 2 requirements under the European Union Cyber Resilience Act (CRA) without any modifications.

As new cybersecurity and cyber resilience laws emerge globally, manufacturers are compelled to provide reliable statements regarding risk assessments and appropriate measures for the cyber resilience of their products.

One of the critical features that played a vital role in EtherCAT meeting these new requirements is its on-the-fly processing of Ethernet frames with dedicated EtherCAT chips. This architecture completely isolates the EtherCAT segment from the IT network, significantly reducing the attack surface. EtherCAT chips immediately discard all non-EtherCAT-specific Ethernet frames. Furthermore, the EtherCAT device protocol directly uses the Ethernet frame instead of the Internet Protocol (IP); whereas most malware is IP-based because it requires IP for routing.

### EtherCAT's Security Advantages

• EtherCAT is immune to external attacks; physical access is required for an attack.
• It meets IEC 62443 standard and EU CRA requirements without protocol changes.

Martin Rostan, Executive Director of the EtherCAT Technology Group, states that this demonstrates EtherCAT already meets high security standards. IEC 62443 forms the basis for cybersecurity measures and processes for industrial control systems and paves the way for European CRA standards.

### Future Plans
For applications with high security demands, ETG is working on protocol extensions that do not require hardware changes. Additionally, ETG plans to establish its own certification authority to allow its members to sign and verify EtherCAT device description files and software according to a standard.

This development will significantly contribute to strengthening cybersecurity in the industrial Ethernet domain.

---

For more cybersecurity content, other news from Automation World:

• Ixana’s new chip eliminates the need for USB ports in closed IoT devices.
• ISA publishes new industrial control systems cybersecurity guidelines.
• AI is transforming cybersecurity in manufacturing, from threat detection to compliance automation.