Cybersecurity & Product Security

Yes. The CRA covers all products with digital elements, meaning hardware and software with firmware or a direct or indirect data connection to a device or network. This includes gateways, RTUs, dataloggers, I/O modules with communication interfaces and SENECA software.

From 11/09/2026, manufacturers must report actively exploited vulnerabilities and severe incidents via the ENISA platform (24 h / 72 h / final report). From 11/12/2027, all essential requirements apply: products placed on the market must comply with the CRA and bear CE marking also covering cybersecurity.

No. The CRA’s design requirements apply to products placed on the market from 11/12/2027. However, the reporting obligations under Art. 14 also apply to products already on the market: this is why SENECA handles reports on all products, including those installed before that date.

Email security@seneca.it with the product, code, hardware/firmware versions, description, steps to reproduce, impact and any evidence. You will receive an acknowledgement with a PSIRT identifier. Do not send passwords or credentials.

SENECA informs affected users and publishes Security Advisories on this page and in the Newsroom, including mitigation measures and fixed versions. You can subscribe to the SENECA newsletter to receive technical updates.

The CRA requires manufacturers to define a support period for each product, normally no shorter than 5 years unless a shorter use is expected, during which security updates must be provided. SENECA will specify the support period in the documentation for CRA-compliant products.

It is the standard defining technical security requirements for components of industrial automation and control systems (IACS). Each requirement can be met at a Security Level from SL1 (protection against accidental violations) to SL4 (protection against sophisticated attacks with extensive resources). For the PASS / SSD series, the independent assessment documents the Security Level achieved for each applicable requirement, up to SL4.

NIS2 requires risk management throughout the supply chain as well. Devices with strong authentication, encryption, segmentation, audit logs and secure updates, together with independent testing and compliance documentation, provide the evidence required in questionnaires and audits for essential and important entities.

Connected radio products placed on the market from 1 August 2025 are subject to the cybersecurity requirements of Delegated Regulation (EU) 2022/30 (EN 18031). Models such as Z-LTE-CEI and MY2-CEI comply with the RED DA; for other models, the product’s EU Declaration of Conformity is authoritative.

The CRA requires manufacturers to draw up a software bill of materials (SBOM) as part of the technical documentation. SENECA is integrating the SBOM into its release process; information on third-party components can be provided on request as part of audits and security questionnaires.

Download firmware and software only from the official website www.seneca.it or through SENECA support channels. On PASS / SSD series devices, firmware is digitally signed and secure boot prevents unauthentic images from starting.

Change credentials at first login, enable 2FA where available, disable unused services and ports, separate the OT network from the IT network, use only encrypted VPNs for remote access (e.g. LET’S / VPNBOX2), send logs to a SIEM, back up the configuration and install security updates regularly.

From 20/01/2027, machinery manufacturers must consider protection against corruption and unauthorised access that could compromise safety. Components with documented IEC 62443-4-2 requirements, intervention logs and traceable updates simplify this assessment.

Yes, on devices you own and in test environments, in accordance with the rules set out on this page: no impact on production or third-party systems, no DoS against SENECA services and no social engineering. Report results to security@seneca.it in line with coordinated disclosure principles.