Testing laboratory and consultancy · Granges-Paccot

Book a call

Cybersecurity risk assessment

Threat analysis (TARA)

What needs protecting, who might attack, how and with what consequences: threat analysis is the starting point of a product’s cybersecurity. The Cyber Resilience Act requires it, and EN 18031 and IEC 62443 build on it. Säfeli runs it in workshops with your teams and turns it into concrete requirements.

Book a 30-minute callSee our services
CRA: risk assessment mandatory
Art. 13
Requirements justified one by one
Annex I
Confidentiality, integrity, availability
C · I · A
Throughout the support period
Up to date

Who it is for

When to carry out a threat analysis

  • New product

    As soon as the architecture is known, to design security in rather than bolt it on.

  • Existing product

    Before 11 December 2027, as the basis for CRA compliance.

  • New feature

    New interface, app, cloud connection: new risks to assess.

  • After a test or a vulnerability

    Update the analysis with what has been learned.

Our services

Our approach, in four stages

A structured, traceable method, from the product model to the security requirements, that fits into your technical documentation.

Engineer examining the circuit board of a connected device
Product model

Describe the product and what needs protecting

Functions, architecture, physical and radio interfaces, app, cloud, data flows and trust boundaries: we build the product model and the inventory of its assets, data, functions, keys and firmware.

What you receive

  • Architecture and data flow diagram
  • Inventory of assets and interfaces
  • Intended use and conditions of use

References

  • CRA, Art. 13(3)
  • EN 18031-1:2024, clause 5
Glowing network in which attack paths are stopped by barriers
Threats

Identify threats and attack scenarios

For each asset, what could compromise its confidentiality, integrity or availability, and by which path: debug interface, radio, app, update. We build the scenarios in workshops, looking at the product through an attacker’s eyes.

What you receive

  • Threat catalogue
  • Attack scenarios and paths
  • Attacker assumptions

References

  • ETSI TS 102 165-1
  • ISO/SAE 21434:2021*
Field of glowing columns, most of them blue, a few orange
Assessment

Assess and treat the risks

Impact of each scenario, attack feasibility based on the time, expertise, equipment and access required, risk level, then the decision: reduce, avoid, transfer or accept. Each measure becomes a traceable security requirement.

What you receive

  • Risk matrix
  • Security requirements and measures
  • Justified residual risks

References

  • CRA, Annex I
  • IEC 62443-3-2:2020
Glowing infinity-shaped loop dotted with points
Follow-up

Integrate and keep up to date

The analysis is linked to the requirements of CRA Annex I or EN 18031, feeds the test plan and goes into the technical documentation. We update it after testing, a vulnerability or a change to the product.

What you receive

  • Mapping to Annex I or EN 18031
  • Security test plan
  • Updates throughout the support period

References

  • CRA, Art. 13(2) and (4)

Also

Cyber Resilience Act

What the CRA expects from the analysis

The regulation does not set a method, but it does set a minimum content. Our analysis addresses it point by point.

  • Intended and foreseeable use

    The analysis starts from the intended purpose of the product and its reasonably foreseeable use, including by less experienced users.

    CRA, Art. 13(3)

  • Conditions of use

    Operational environment, assets to protect, connections: the same product does not carry the same risks in a living room as in a factory.

    CRA, Art. 13(3)

  • Period of use

    The expected period of use of the product, which is also used to set the support period and how long security updates are provided.

    CRA, Art. 13(3) and (8)

  • Justified requirements

    The analysis states which requirements of Annex I apply and how they are implemented. Any requirement set aside is justified in writing.

    CRA, Art. 13(3) and (4)

  • Documented and in the technical file

    The analysis is part of the technical documentation provided to the authority on request.

    CRA, Art. 13(4); Annex VII

  • Kept up to date

    It is kept up to date throughout the support period: new vulnerability, new function, test results.

    CRA, Art. 13(2)

Standards

Reference methods

The CRA does not impose a method. We draw on the recognised frameworks of your product’s sector.

SectorStandardScope
All productsRegulation (EU) 2024/2847, Art. 13Minimum content of the cybersecurity risk assessment
RadioEN 18031-1, -2 and -3:2024Assets, interfaces and decision trees per mechanism
IndustryIEC 62443-3-2:2020Risk assessment, zones and conduits, target security level
TelecomsETSI TS 102 165-1 V5.3.1Threat, vulnerability and risk analysis (TVRA)
AutomotiveISO/SAE 21434:2021*Road vehicles cybersecurity engineering, TARA

* Reference to be checked for your project. Vehicles are covered by their own legislation and excluded from the Cyber Resilience Act; the ISO/SAE 21434 TARA method nevertheless remains a useful source for other products.

Our approach

Your threat analysis in four steps

  1. Discovery call

    Your product, its architecture, your markets and your timeline. 30 minutes.

  2. Preparation

    Architecture documents, schematics, list of components and interfaces.

  3. Workshops

    Product model, threats, attack scenarios, assessment, with your teams.

  4. Report

    Documented analysis, security requirements, test plan, ready for the technical file.

Frequently asked questions

Frequently asked questions on threat analysis

Does your product raise a specific question? Ask an engineer directly.

Book a call
What does TARA stand for?

Threat Analysis and Risk Assessment. You describe the product and what needs protecting, imagine how an attacker could go about it, assess the severity and feasibility of each scenario, then decide on the measures. The term comes from the automotive industry, but the approach works for any connected product.

Sources: ISO/SAE 21434:2021, clause 15 (to be checked); ETSI TS 102 165-1

Is a threat analysis mandatory?

For the Cyber Resilience Act, yes: the manufacturer must assess the cybersecurity risks of its product, document the assessment, include it in the technical documentation and keep it up to date. For the Radio Equipment Directive, EN 18031 requires the assets and interfaces of the product to be analysed to decide which requirements apply.

Sources: Regulation (EU) 2024/2847, Art. 13(2) to (4); EN 18031-1:2024, clause 5

Which method should be used?

The CRA sets the minimum content of the analysis but does not impose a method. We draw on recognised methods, such as ISO/SAE 21434 in the automotive sector, the ETSI TVRA for telecommunications or IEC 62443-3-2 for industrial systems, and adapt the depth of the analysis to your product.

Sources: Regulation (EU) 2024/2847, Art. 13; IEC 62443-3-2:2020; ETSI TS 102 165-1

How does it differ from the CE marking risk assessment?

The CE marking risk assessment, for example to ISO 12100 for machinery, deals with hazards to people: moving parts, electricity, heat. The threat analysis deals with intentional attacks on the product and its data. The two meet when an attack can create a hazard, as on connected machinery.

Sources: Machinery Regulation (EU) 2023/1230, Annex III, 1.1.9; Regulation (EU) 2024/2847, Art. 13

Who should take part?

The people who know the product: electronic architecture, embedded software, app and cloud, plus someone who knows the customers and real-world use. We facilitate the workshops, ask the questions an attacker would ask and write up the analysis.

When should it be carried out?

As early as possible, as soon as the architecture is known: changing a design choice costs far less than fixing a finished product. For an existing product, it serves as the starting point for CRA compliance.

Book a call

Tell us about your product

Book a 30-minute slot with an engineer directly. No back-and-forth by email: you choose the time, we prepare the call.

Choose a time slot

Contact details

Address
Säfeli Sàrl
Route d'Englisberg 3
1763 Granges-Paccot
Languages
French, German, English
Book a call