Apps have become an indispensable part of modern automation. They add new functions to existing systems, can be used flexibly, and can significantly reduce development times. However, this flexibility also increases the importance of cyber security. After all, the Cyber Resilience Act (CRA) does not only apply to traditional hardware products.
Software can also be considered a product with digital elements and therefore be subject to the requirements of the CRA. This brings a new question into focus: What does the CRA mean for apps and digital marketplaces such as the PLCnext Store?
This question was also the focus of a session by Boris Waldeck our Master Specialist Security at the PLCnext Community Summit 2026. In his presentation, he explains what the CRA means for software applications and which requirements app developers need to consider. You can watch the session on YouTube.
Apps become part of the CRA assessment
Anyone who develops and provides software will need to take a closer look at the security properties of their application in the future. This starts with one key question: What is my app intended for and in what environment will it be used?
The intended purpose and the respective security context can be used to determine the risks to which an application may be exposed. The resulting risk analysis, in turn, forms the basis for determining which security requirements are relevant to the app. After all, not every application requires the same protective measures. An app used within a protected automation environment may have a different risk profile than software that communicates with external systems or networks. This is precisely why risk analysis plays such an important role in the CRA: It helps identify the risks relevant to the specific intended use and derive the necessary security requirements from them.
Security must be considered from the outset
As with hardware, the same applies to apps: Cyber security is difficult to integrate retrospectively. Security should therefore be considered as early as the architecture and development stages of an application. This includes, for example, protecting data, implementing appropriate authentication and authorization concepts, securing interfaces, and using mechanisms that can detect tampering. For app developers, this means: Security is not an additional step shortly before release, but an integral part of the development process. From secure code to secure app distribution.
However, a secure app alone is not enough. Its secure distribution is also crucial. The PLCnext Store provides the interface between app developers and users in the PLCnext Ecosystem. This means that the app’s journey from the developer to the target system also becomes part of the security assessment. This is where the infrastructure of PLCnext Technology and the PLCnext Store comes into play: Apps are signed so that their integrity and authenticity can be verified. This makes it possible to determine whether software has been modified on its way from the developer to the target system. The underlying idea is simple: It is not enough for the app itself to be developed securely. It must also be ensured that users receive exactly the software that was intended.
More control for operators
Particularly in industrial systems, it may also be crucial to determine which applications are permitted to be installed on a device in the first place. Operators can specify, for example, that only apps that have previously been reviewed and approved for the respective environment may be used. In addition to developer and store signatures, an additional operator signature can be used for this purpose. Devices configured accordingly can therefore be restricted to applications that have this specific approval. This means that security is not solely the responsibility of the app developer. Operators can also incorporate their own security requirements into the use of apps. Security by Design with PLCnext Technology Implementing the CRA requirements does not mean that app developers have to develop all security mechanisms themselves from scratch. PLCnext Technology provides various platform functions that apps can use:
- secure runtime environments and rootless Podman containers,
- secure default settings in line with Secure by Default,
- encryption when transmitting and storing data,
- signatures and integrity checks,
- user, role, and authorization concepts,
- firewall and Netload Limiter, as well as
- logging, notification, and syslog functions.
This offers a key advantage: Developers can use existing security functions and take them into account when implementing the requirements relevant to their application.
Transparency becomes a key factor
With the CRA, another aspect is gaining importance alongside technical security mechanisms: transparency. Users, machine builders, and system integrators need to be able to understand the status of software and which information is relevant to its secure use. The PLCnext Store therefore provides key information and documentation such as security documentation, the CE declaration of conformity, and CE marking for published apps. This supports app providers in publishing their apps in compliance with the CRA, while providing users with relevant information directly in the context of the respective application. This makes the PLCnext Store much more than a platform for providing software. It becomes an important building block for transparency, security, and lifecycle management.
An ecoystem for secure apps
The strength of PLCnext Technology lies in the interaction between the platform, apps, and partners. Apps from the PLCnext Store can be used on compatible systems from different manufacturers. This provides users with greater flexibility while also giving app developers the opportunity to make their solutions available to a broader user base. Cyber security plays a crucial role, especially in an open ecosystem. For us, openness and security are not contradictory. What matters is that openness is based on clearly defined security processes and technical mechanisms.
Conclusion: Taking a collaborative approach to cyber security
The Cyber Resilience Act makes one thing clear: Cyber security does not end at the boundary of a physical product or with the development of an app. Development, distribution, installation, updates, and vulnerability management must be considered together throughout the entire lifecycle. With PLCnext Technology and the PLCnext Store, we provide the right framework for this. App developers can use the platform’s existing security functions and integrate security into their applications from the outset. At the same time, we provide users with greater transparency and support them in securely integrating apps into their automation solutions.
Cyber security is not the responsibility of a single stakeholder. Developers, platform providers, and operators all contribute to making apps and automation solutions secure and future-proof in the long term.
Do you develop apps yourself or are you looking into the impact of the CRA on your software? Watch the session from the PLCnext Community Summit 2026 to learn more about the CRA requirements for apps in the PLCnext Store.
You can also discover PLCnext Technology and our 360° security approach to find out how we support you in considering cyber security from the outset.
