+49 9181 50980-0

info@moderndrive.de
Main Menu
Contact
Contact
Main Menu

Cyber Resilience Act

You're the manufacturer. We'll handle the delivery.

The General Data Protection Regulation ( Cyber Resilience Act ) (Regulation (EU) 2024/2847) requires manufacturers of connected products to ensure security throughout the entire product lifecycle. If your machine uses MACHINES.cloud for telematics, remote access, or OTA updates, you are the manufacturer and we are your supplier. Here is what we provide for this purpose. This is based on Section 11 of our EULA V2.5, including Appendix 2.

As of October 28, 2026 · EULA V2.5

The reporting requirements have been in effect since September 2026.

In effect

The " CRA " has taken effect. The requirements will be implemented in phases.

Reporting Requirements

Vendors must report actively exploited vulnerabilities and serious security incidents (Art. 14).

All Obligations

Safety requirements, conformity assessment, and CE marking in accordance with the CRA.

Who has which role.

The role depends on who markets the product under its own name.

You

Manufacturer of the machine

They assess the risks, conduct the conformity assessment, determine the support period, and report to ENISA and the relevant Computer Security Incident Response Team (CSIRT).

We

Suppliers and Operators

We operate MACHINES.cloud, address vulnerabilities in our components, notify you of security incidents, and provide you with the information you need to file reports.

Equipment We Supply

Retailer

For devices from Teltonika and Digital Matter, the device manufacturer remains the manufacturer. We provide you with the manufacturer's compliance documentation and safety information.

Your deadlines as a manufacturer.

This is required by Article 14 of the German Civil Code ( CRA). The time limits begin to run from the date you become aware of the matter.

24 h
Early Warning
to ENISA's central reporting platform as soon as you become aware of an actively exploited vulnerability or a serious incident
72 h
Announcement
with initial information on the nature, impact, and countermeasures
14 days
Final Report
depending on the availability of a fix for vulnerabilities; within one month in the case of serious incidents

To help you meet these deadlines, we will notify you of security incidents that may affect your instance as quickly as possible and within the statutory time limits, even in cases of reasonable suspicion (Section 11.5, Appendix 2).

What We Offer.

This is based on Section 11 of the EULA V2.5, along with Appendix 2 (Reporting of Security Incidents and Vulnerabilities) and Appendix 1, Section 6.

  • Reporting Security Incidents

    Classification into three levels; initial report without waiting for a full investigation; status updates every 24 hours until the issue is resolved; final notification.

    Section 11.5 · Appendix 2

  • Support for Your Reports

    The information we have on file for your report after 72 hours and your final report.

    Section 11.5

  • Software Bill of Materials (SBOM)

    Machine-readable in CycloneDX format for our components by release version, upon request.

    Section 11.4 · Appendix 1

  • Security Updates

    We provide updates for our components free of charge during the term of the contract, separate from feature updates where possible. We install platform updates.

    Sections 11.2 and 11.3

  • Information from the platform

    We will share safety information and documentation from Cumulocity GmbH with you to the extent permitted.

    Section 11.3

  • Notice of the End of Support

    At least six months in advance, unless security reasons or platform requirements call for a shorter notice period.

    Section 11.7

Frequently Asked Questions.

Do you register us with ENISA?
No. The manufacturer submits the report to ENISA’s central reporting platform and the relevant CSIRT. We will provide you with the necessary information and coordinate with you.
Who updates the firmware on the gateways in the field?
As the manufacturer, you are responsible for this. At your request, we will install OTA updates on your behalf and upon your approval (Section 11.3).
Our support period is longer than the contract. What happens then?
This is the standard practice: Manufacturers typically guarantee five years or more. We make separate arrangements for security updates, continued operation, or software bill of materials beyond the end of the contract (Section 11.7).
Is there a written agreement regarding the reporting chain?
Yes. In the EULA V2.5, it is Exhibit 2 to the agreement. If you have an older version of the agreement, we will enter into it as a separate agreement until the transition is complete.
How do we report a vulnerability to you?
Send an email to psirt@moderndrive.de. For more information, see " Report a Vulnerability."