The challenge

WashTec operates connected car wash systems worldwide, along with the associated software and cloud solutions. The Cyber Resilience Act (CRA) requires these products to meet new cybersecurity standards. Development processes, digital components, updates, and the handling of security vulnerabilities needed to be designed in a way that is both practically implementable and legally compliant. The diversity of connected machines, the interplay of hardware, software, and cloud, as well as the involvement of supply chains made this particularly complex. WashTec also needed a transparent development process applicable across all products.

How we helped

In a two-day workshop, we collaboratively developed concrete steps to prepare for the CRA. We started by conveying the key fundamentals of the CRA and providing a clear overview of the requirements relevant to WashTec. We then jointly analyzed the affected products with a focus on digital and connected components, and conducted a gap analysis covering product security, a secure product development process, and the handling of cybersecurity vulnerabilities and incidents. Together, we identified and prioritized the necessary measures and documented them in an initial roadmap with defined responsibilities. This gave WashTec a solid foundation for systematically advancing product cybersecurity and CRA compliance.

Methods