Panasonic Industry Earns IEC 62443-4-1 Certification

Estimated reading time: 2 minutes

Panasonic Industry Co., Ltd. has achieved certification under the international standard “IEC 62443-4-1,” which defines secure product development lifecycle processes for industrial automation and control systems (IACS). This certification applies to the target products of its Industrial Device Business Division, which provides these industrial automation and control system products.

In connection with this certification, and as part of its response to the EU Cyber Resilience Act (CRA), we have newly published website covering its product security policies and vulnerability information for the relevant businesses.

As IoT adoption and Digital Transformation rapidly advance across manufacturing sites and infrastructure facilities, the risks of suspending production and information leaks from cyberattacks have become increasingly apparent worldwide, making security measures for industrial control systems more critical than before. Against this backdrop, Europe has enacted the Cyber Resilience Act (CRA) in December 2024, which mandates security measures from the design and development stage and disclosure of vulnerability information for products containing digital elements equipped with software and network capabilities. The CRA is scheduled for full enforcement starting in 2027.

Anticipating global regulatory trends, we will continue building product development processes that comply with international standards and establishing a highly transparent information disclosure framework, in order to continuously provide customers with safe and reliable products.

Overview of the International Standard “IEC 62443-4-1” Certification

IEC 62443 is a comprehensive series of international standards concerning the security of Industrial Automation and Control Systems (IACS). Within this series, IEC 62443-4-1 specifies requirements for a secure product development lifecycle. Through this certification, a third-party organization (TÜV SÜD) has confirmed that our consistent security management processes in product design, development, and maintenance conform to international standards.

Compliance with the EU Cyber Resilience Act (CRA) and Publication of the “Product Security Policy”

The EU Cyber Resilience Act (CRA) requires vulnerability management and disclosure of related information throughout a product's lifecycle. As part of its firm commitment to full compliance by the time of enforcement in December 2027, we have now launched a dedicated site on its official website and published the following policies and security information．

1. Product Security Policy: Our Industrial Device Business Division basic policy regarding product security.
2. Vulnerability Handling Policy: The processes for receiving, investigating, and responding to vulnerabilities.
3. Vulnerability Information & Security Advisories: The handling status of discovered vulnerabilities and recommended updated information for customers.