3 Minutes with …
… Florian Wahl

What is your role at Pilz?

As Product and Tech­nology Man­ager at Pilz, one of my tasks is to iden­tify new tech­nolo­gies at an early stage and assess their poten­tial for the com­pany. Stim­ulus comes from areas with direct market access/customer con­tact, but sug­ges­tions from other depart­ments are also incor­po­rated. The aim is to develop research projects or product ideas from these trends. One aspect that’s increas­ingly impor­tant is the con­sid­er­a­tion of reg­u­la­tory require­ments – in par­tic­ular the Cyber Resilience Act (CRA).

What influence does the Cyber Resilience Act (CRA) have on your work?

The CRA does not affect all our prod­ucts to the same extent. Many of our classic safety relays, such as the PNOZ X for example, are not affected by it at all – our cus­tomers can con­tinue to use them as usual. On the other hand, more com­plex sys­tems such as the safe con­fig­urable small con­troller PNOZ­multi or the automa­tion system PSS 4000 require more inten­sive testing and mod­i­fi­ca­tion to ensure they are CRA-com­pliant. One impor­tant ini­tial task is to real­is­ti­cally esti­mate the effort required for all prod­ucts. I see myself as a medi­ator between product man­age­ment and the teams that ulti­mately handle the tech­nical imple­men­ta­tion.

How is Pilz dealing with the new requirements?

Our aim is clear: we want to keep our prod­ucts on the market and make them CRA-com­pliant. We are responding to the new require­ments with a struc­tured and for­ward-looking secu­rity man­age­ment approach, for example. For existing prod­ucts we con­duct a gap analysis to iden­tify require­ments from the CRA and imple­ment them accord­ingly.

On the organ­i­sa­tional side, we are working on making the Product Secu­rity Inci­dent Response Team (PSIRT) ready for the reporting require­ments that are now being added to the existing vul­ner­a­bility man­age­ment process. Vul­ner­a­bil­i­ties are being assessed and the team pro­vides cus­tomers with rec­om­mended actions in the form of Secu­rity Advi­sories to help resolve the iden­ti­fied vul­ner­a­bil­i­ties.

What advice do you give customers when dealing with new regulations such as the CRA?

If there is an oppor­tu­nity to get involved in asso­ci­a­tions such as the VDMA or ZVEI, then we really rec­om­mend it. These net­works thrive on the active par­tic­i­pa­tion of their mem­bers. You can engage in inten­sive dia­logue with market com­peti­tors and cus­tomers. Such net­works are essen­tial, par­tic­u­larly in times of increasing reg­u­la­tory com­plexity. They allow you to iden­tify changes at an early stage and play an active part in the design process. It is impor­tant to stay on the ball and obtain infor­ma­tion as close to the source as pos­sible – that is how we do it at Pilz.