Building cybersecurity into embedded platform development, software maintenance and long-term product support
Geniatech, a provider of embedded computing platforms and customized hardware and software solutions, today introduced its Cyber Resilience Act (CRA) readiness and lifecycle cybersecurity service framework, designed to help industrial device manufacturers address evolving European cybersecurity requirements throughout product development, deployment and maintenance.
As the European Union’s Cyber Resilience Act introduces cybersecurity obligations for products with digital elements, manufacturers face challenges extending beyond initial product security. They must also maintain visibility into software components, assess emerging vulnerabilities, implement appropriate corrective measures and sustain cybersecurity support over defined product lifecycles.
For industrial equipment manufacturers, these requirements are particularly significant. Embedded products often remain in operation for many years, rely on complex software supply chains and require stable operating environments that cannot be upgraded without careful validation.
Geniatech’s approach addresses these challenges by connecting secure platform development with structured vulnerability management and long-term BSP/OS engineering support.
Security Starts with the Embedded Platform
Rather than treating cybersecurity as an additional compliance check performed at the end of development, Geniatech is incorporating Security-by-Design practices into its supported embedded platform development processes.
Building on its experience in System-on-Modules (SoMs), Single-Board Computers (SBCs), customized embedded hardware, Linux BSPs and operating system integration, Geniatech is establishing CRA-ready software baselines for supported platforms.
Depending on the platform architecture and applicable security requirements, these baselines incorporate security risk assessment, secure boot implementation, firmware integrity protection, system hardening, secure configuration and software component visibility.
The objective is to provide customers with a more structured and maintainable software foundation for developing connected industrial products.
From Vulnerability Identification to Engineering Remediation
Identifying vulnerabilities is only the beginning of effective cybersecurity management.
Geniatech’s security workflow combines software component analysis, Software Bills of Materials (SBOMs), Common Vulnerabilities and Exposures (CVE) assessment and engineering-level vulnerability evaluation.
When potential vulnerabilities are identified, Geniatech’s engineering teams assess their relevance to the supported software baseline, considering the affected components, system configuration and potential security impact.
Where remediation is necessary, Geniatech works with upstream technology providers and its internal BSP/OS engineering teams to evaluate security patches, software updates, configuration changes, backports or other mitigation measures.
Applicable changes are then integrated and validated against the maintained platform baseline before release.
This engineering-driven approach is intended to help customers move beyond vulnerability reports toward actionable security maintenance.
Supporting Cybersecurity Throughout the Product Lifecycle
Industrial products require more than a secure initial software release. New vulnerabilities may emerge long after equipment has entered service.
Geniatech’s lifecycle cybersecurity services are designed to support vulnerability monitoring, scheduled security assessments, risk-based remediation, validated BSP updates and security release communication over an agreed maintenance period.
Its standard CRA security maintenance framework is structured around a five-year support period, with two scheduled cybersecurity reviews annually and additional event-driven assessment for critical or actively exploited vulnerabilities affecting the maintained platform.
Security updates may be delivered through agreed BSP release mechanisms, while OTA update integration and deployment services can be provided according to project requirements.
By maintaining defined software baselines and coordinating with upstream component suppliers, Geniatech aims to balance long-term product stability with the need to address evolving cybersecurity risks.
Flexible Support for Different Software Ownership Models
Embedded manufacturers differ significantly in how they develop and maintain their products.
Some customers use Geniatech’s standard BSP/SDK as a foundation for their own firmware. Others require Geniatech to take a greater role in software integration, security maintenance or update delivery.
Geniatech’s CRA-related services are therefore structured around clearly defined software ownership, maintenance responsibilities and project-specific support requirements.
Depending on the agreed scope, customers may obtain platform software and supporting security information, ongoing vulnerability assessment and remediation services, or additional software update and lifecycle management support.
For customer-developed applications, modified BSP components and final product firmware, responsibilities are established according to the actual development, delivery and maintenance scope.
This approach enables customers to retain control over their proprietary software while obtaining engineering support for the Geniatech-controlled platform components.
Enabling Long-Term Industrial Product Development
Geniatech sees cybersecurity maintenance as an increasingly important part of embedded product lifecycle planning.
By combining hardware development, BSP/OS engineering, security analysis, vulnerability remediation and long-term support, the company aims to help industrial manufacturers reduce software maintenance complexity and prepare the technical foundations needed for CRA compliance activities.
The framework is particularly relevant to long-lifecycle applications in industrial automation, smart infrastructure, energy management, transportation and connected equipment.
“For embedded product manufacturers, cybersecurity cannot end when the hardware is delivered,” said Fang CEO, Geniatech. “Our focus is to help customers establish a secure and maintainable platform foundation, supported by practical engineering capabilities and clearly defined lifecycle responsibilities. This allows manufacturers to address cybersecurity requirements without losing control of their own product development.”
Geniatech’s CRA readiness services support customers’ cybersecurity and compliance preparation activities. Final product conformity assessment and regulatory obligations remain subject to the applicable product classification, manufacturer responsibilities and agreed scope of work.
For more information about Geniatech’s embedded computing platforms and CRA-related cybersecurity services, visit www.geniatech.com or contact the Geniatech sales team.