A look back at the latest Safety and Security Day hosted by Chubb at Lille’s Pierre-Mauroy Stadium on 6 October. The conference programme offered expert insights into a wide range of safety and security topics, including a presentation by SPAC Alliance on the cybersecurity challenges associated with NIS 2. Here are the key takeaways:
- Physical security and cybersecurity must be addressed together across an organisation’s systems, including building management and control systems.
- For manufacturers, integrators and end users alike, security depends as much on how products are integrated and maintained as on the products themselves.
- Trust rests on evidence: documentation, assessments and certifications.
- SPAC Alliance supports the industry in securing communications, preparing for compliance and developing circular economy solutions.
No more blind spots in security
Although the presentations covered a broad range of topics, from fire suppression systems and PFAS to regulations and connected services, they highlighted a common need to move beyond siloed approaches.
The convergence of physical security and cybersecurity is now recognised across most security disciplines. The NIS 2 and Critical Entities Resilience (CER) directives contribute to this holistic approach, which is also reflected in security frameworks, standards and guidance.
Building management and control systems illustrate this convergence: protecting a building also means securing its connected equipment, communications, and physical and digital access.
Security requires evidence
As the presentations made clear, every link in the security chain must play its part without weakening those that come before or after it.
Under the Cyber Resilience Act (CRA), manufacturers of connected products, both hardware and software, will have to meet essential cybersecurity requirements: security by design, security by default, and vulnerability handling throughout a support period aligned with the product’s expected use time.
Meeting these requirements relies on documented processes and assessments. Certifications may also contribute, depending on their scope (ANSSI’s CSPN, CNPP Certified, SSCP Certified).
Under NIS 2 and CER, entities within scope will need to assess their risks, implement appropriate and proportionate security measures, and demonstrate their effectiveness. Documentation provided by suppliers and service providers, including security features, requirements for maintaining security, assessment reports and certificates, will support their risk assessments and compliance evidence alongside their own policies, procedures and internal measures.
From supplier to partner
Responsibilities are now clearly defined and allocated. Countering modern threats means recognising the importance of security that is consistent, coherent and sustained over time.
Achieving this balance requires collaboration between all stakeholders, each with a role to play:
- End users, to understand the challenges and organise their protection.
- Manufacturers, to innovate and provide the necessary technologies.
- Integrators, installers and maintenance providers, to design, deploy and maintain solutions suited to users’ needs.
- Public authorities and institutions, to keep the framework aligned with operational realities.
Chubb keeps the momentum going
This event was a clear example of what is needed: bringing expertise together, looking ahead and building for the long term on a shared understanding of the challenges. Across fire safety and security, Chubb’s activities already bring together products, installation and services.
Against this backdrop, alongside our members Aritech, Genetec and STid, we highlighted SPAC Alliance’s role in connecting the industry and presented the tools available to help turn this shared vision into practical action:
SSCP: securing communications
SSCP is the open, sovereign high-security protocol championed by SPAC Alliance and its 74 members. It continues to evolve, helping the industry anticipate both emerging threats and regulatory developments. Already an industry standard used in numerous CSPN-certified solutions, SSCP is now moving towards formal standardisation.
HESTIA: preparing for CRA compliance
The CRA is raising awareness across the entire ecosystem. It is reshaping product design, market access and responsibilities. The outcomes of the HESTIA project, whose pre-standardisation work contributes to the development of EN 40000-10, were well received. They inform the tools and services that will support manufacturers in achieving compliance.
Circular economy: responsible end-of-life management
The circular economy pilot project presented at the General Assembly attracted considerable interest. Through this initiative, SPAC Alliance is translating CSR commitments into practical action with measurable outcomes. Follow-up meetings have been arranged to define and test further use cases that will benefit the wider industry.
A final word
Thank you to Chubb for organising the event, to the speakers for their insights, and to everyone who contributed to the discussions. These events bring expertise together and help us advance safety and security as an industry.
