On 15 October, SPAC Alliance took part in a roundtable at IBS exploring the implications of the Cyber Resilience Act (CRA) for smart buildings. From manufacturer and supplier readiness to end-user procurement specifications, here are the key takeaways from our discussion.
Moderated by Philippe Grange (MEDIA DELL’ARTE), the panel brought together Ronan Jezequel, Director of Innovation & Development at CNPP, Serge Le Men, Smart Building Solutions Manager at ABB, Claire Loiseaux, President of Internet of Trust, and Mickaël Wajnglas, Secretary General of SPAC Alliance.
A shared responsibility
Cybersecurity does not end when a product reaches the market or undergoes a conformity assessment. It requires security by design, vulnerability management, updates and ongoing maintenance.
The entire security supply chain must prepare to meet the expected requirements. Manufacturers, importers, distributors and integrators will need to demonstrate the compliance of products with digital elements under the CRA, while entities covered by NIS 2 will face governance and risk management obligations.
Achieving NIS 2 compliance will involve updating procurement criteria: what assurances should buyers seek from suppliers? What evidence of compliance should they require? How can they plan for equipment support throughout its operational life?
Resources to prepare for compliance
The industry can draw on several resources: the IEC 62443 series, GIMELEC’s Cyber BACS Flex Ready framework, developed with Internet of Trust in cooperation with ANSSI, and ANSSI’s guide to securing building management and control systems.
These resources help translate regulatory requirements into technical decisions and operational practices. Their use remains voluntary, unless specific legal or contractual provisions make them binding, and does not replace the need to demonstrate compliance with applicable obligations.
SPAC Alliance, the SSCP protocol and EN 40000-10
We highlighted that ANSSI’s guide includes physical security systems, particularly access control and video surveillance, within its scope. Securing a building therefore means protecting these systems and their communications alongside its other technical systems.
This approach aligns with our work through HESTIA, our collaborative project enabling the access control and electronic physical security industry to contribute to the development of the future European harmonised standard EN 40000-10. It also underlines the importance of secure communication protocols such as SSCP.
As the CRA’s main application date of 11 December 2027 approaches, the challenge is to turn this collective effort into design choices, procurement requirements and documented evidence. Smart buildings must combine connectivity, interoperability and security.
Thank you to Philippe Grange and our fellow panellists for the discussion, and to the members and partners we met at the event, including SBA, FDI and STid.
