SEW-EURODRIVE integrates cybersecurity into its products and services, as well as throughout the company and its manufacturing operations. With an ISO 27001-certified Information Security Management System, an IEC 62443-4-1-certified Product Security Management System (Security by Design), and the gradual implementation of “Security Inside” features, SEW-EURODRIVE protects its drive and automation solutions throughout their entire lifecycle.
In this way, we support our customers in the practical implementation of European Union regulatory requirements, such as the Cyber Resilience Act (CRA), the Machinery Regulation, and the Network and Information Security Directive 2 (NIS2).
- Cybersecurity. Anchored in our organization.
- Cybersecurity. Integrated in our product.
- Cybersecurity. Implemented in practice.
- Cybersecurity. Supported throughout the lifecycle.
The availability and security of networked drive and automation technology are becoming increasingly important.
As digitalization continues to advance across manufacturing environments, the threat landscape is expanding. That is why we are committed to helping our customers meet regulatory requirements, including the Cyber Resilience Act (CRA), the Machinery Regulation (MVO), and the NIS2 Directive. Our goal is always to reduce the risk of production downtime and prevent unauthorized manipulation within drive and automation technology environments.
Cybersecurity is systematically integrated into the development, production, and maintenance of our drive and automation solutions. The benefit for you as a machine manufacturer or operator: SEW-EURODRIVE develops its drive and automation systems step by step according to the principles of Security by Design. Vulnerabilities and potential threats are addressed through defined processes, and you are kept informed through security notices and updates (Security Advisories).
We rely on an IEC 62443-4-1-certified Secure Development Lifecycle (SDL) process, our own Cybersecurity Emergency Response Team (CERT), and clearly defined procedures for identifying, reporting, assessing, and remediating vulnerabilities. In addition, SEW-EURODRIVE is registered as a Very Important Entity under the NIS2 Directive.
This will take effect in 2027:
Machines and digital products that fall within the scope of the Machinery Regulation (will replace the current Machinery Directive) and the new Cyber Resilience Act CRA will be required to demonstrate compliance with the applicable cybersecurity requirements. Only then can they meet the conditions for CE marking and be placed on the European Single Market.
This means:
- Only by complying with the relevant requirements of the Machinery Regulation is it possible to affix a CE marking to the machines in question.
- Only by complying with the requirements of the CRA, affected digital products and connected devices with digital elements can obtain CE marking.
- Only with cybersecurity certifications will market authorization in the EU be possible in the future.
We're up for it! At SEW-EURODRIVE, cybersecurity is integrated consistently throughout the entire product lifecycle.
- We will ensure a simple and intuitive user experience throughout.
- We will roll out new security features gradually, consistently, and at no additional cost from the factory.
First CE markings in accordance with cybersecurity requirements
SEW-EURODRIVE has signed the first CE markings in accordance with the new cybersecurity requirements of the Machine Regulation for a selection of drive technology products from the MOVI‑C® modular automation system:
- MOVITRAC® advanced standard inverter
- MOVITRAC® classic standard inverter
- MOVIMOT® flexible decentralized inverter
- MOVIPRO® technology decentralized inverter
- MOVIMOT® advanced drive unit
- MOVIMOT® performance drive unit
- MOVIGEAR® performance drive unit
Additional products will follow.
SEW-EURODRIVE provides EU declarations of conformity for the affected products that take into account the requirements of the Machinery Regulation (MVO). You can find these documents in the “Data and Documents” section under “Quality Documentation.”
As a pioneer in drive technology, we integrate security by design into all our solutions and products and, as a highly skilled partner, we support our customers through a secure digital transformation.Dr. Hans Krattenmacher
Managing Director Corporate Innovation Mechatronics
Security by Design
SEW-EURODRIVE is gradually developing drive and automation systems in accordance with the principles of Security by Design – from development through production to deployment at the customer site. Risks are addressed early on, and safety measures are taken into account throughout the entire lifecycle.
Security Inside
New security features are being gradually integrated into products, solutions, and digital services:
- Secure User Management
- Secure Logging
- Secure Update
- Secure Communication
- Secure Commissioning und Secure De-Commissioning
Your benefit:
- The rollout of these Security Inside features is designed to be straightforward and requires minimal effort, with all features provided as standard and at no additional cost.
- Existing part numbers, product type designations, and familiar engineering tools will remain unchanged.
- In many cases, existing systems and machines can be upgraded to a secure firmware version with minimal impact on current operations.
Cybersecurity. Embedded from the very beginning.
Cybersecurity. Integrated into the product.
Protecting information technology and operational technology
Our Information Security Management System (ISMS) is certified in accordance with ISO/IEC 27001 and provides the foundation for a structured approach to information security management. In addition, SEW-EURODRIVE is registered as a Very Important Entity (VIE) under the NIS2 Directive, underscoring our commitment to maintaining a high level of cybersecurity and resilience. In addition, we take into account the requirements of the EU Data Act regarding secure data access, data exchange, and interoperability mechanisms for connected products and digital services.
Data protection in customer support
SEW-EURODRIVE processes personal data on behalf of its customers, including employee-related information, and implements appropriate technical and organizational measures to protect privacy rights and ensure compliance with data protection requirements.At the same time, we ensure that data is handled securely and in compliance with regulations in connected products, digital services, and IT and OT environments (GDPR and the EU Data Act).
Product security management – PSM
Our Product Security Management (PSM) ensures that our products, applications, and system solutions remain protected throughout their entire lifecycle. A centralized Computer Emergency Response Team (CERT) identifies, assesses, and manages security vulnerabilities and publishes Security Advisories. Our Product Security Management System is certified in accordance with IEC 62443-4-1 and provides the foundation for implementing current requirements, such as the Machinery Regulation, the Cyber Resilience Act (CRA), or the Radio Equipment Directive (RED).
You ask – we answer!
What is the difference between Security and Safety?
Safety refers to all measures aimed at preventing unintentional hazards and accidents. Safety thus protects people and the environment from machines.
Security focuses on protection against malicious or criminal attacks. Security thus protects machines from people.
What is Product Security?
Product Security is the protection of products against unauthorized access, manipulation, loss, or destruction.
Are SEW-EURODRIVE products cybersecurity compliant?
Yes. We continuously enhance our Product Security measures to ensure compliance with evolving cybersecurity requirements and standards.
Is there a specific product labeling requirement for cybersecurity?
No. Cybersecurity is becoming part of CE conformity. Under the CRA), manufacturers must demonstrate that their connected products meet defined cybersecurity requirements. Cybersecurity is thus becoming an integral part of product conformity.
Do you have specific projects you'd like to carry out?
Use the “Contact” link below to find your local contact person for any questions or concerns you may have.
By activating the zip code search, data is transferred to the USA by Google. For more information, see our privacy policy.
NIS2 Directive (EU 2022/2555) – Cybersecurity at the Organizational Level
The NIS2 Directive strengthens the cyber resilience of essential and important entities.
Among other things, companys are required to:
- Establish a cybersecurity risk management framework.
- Define clear responsibilities.
- Report security incidents.
- Inform service recipients.
- Fulfill registration, documentation, and compliance reporting obligations.
Cyber Resilience Act (CRA) – Cybersecurity at the Product Level
As of December 11, 2027, the Cyber Resilience Act (CRA) will apply to all products with digital elements placed on the EU market.
Among other things, it requires:
- Conduction of threat and risk analysis.
- Implementation of Security by Design and Security by Default.
- Regular security assessments.
- Management and reporting of vulnerabilities.
- Provision of security updates.
Machinery Regulation – Cybersecurity at the Machine Level
As of January 20, 2027, the Machinery Regulation will replace the current Machinery Directive.
A key change is that cybersecurity becomes a mandatory responsibility for manufacturers.
Among other things, manufacturers are required to:
- Prevent unauthorized access.
- Ensure appropriate logging.
- Consider safety-related software.
Radio Equipment Directive (RED) – Cybersecurity for Radio Equipment
As of August 1, 2025, additional cybersecurity requirements apply to radio equipment under the Radio Equipment Directive (RED).
Products that use radio waves and do not comply with the applicable RED requirements may no longer be placed on the market in the European Union (EU) or the European Economic Area (EEA).
EU Data Act – Requirements at the Data and Connectivity Level
Effective September 12, 2025.
The regulation strengthens the rights of users of connected products and related services while creating a harmonized framework for accessing, using, and sharing data across the European Union.