The IoTSF Plenary

Sponsored by: PA Consulting

The EU Cyber Resilience Act (CRA) is set to fundamentally change how connected products are designed, developed, secured, and maintained – yet many organisations are still underestimating the scale of the challenge.

This event brings together security leaders, product teams, compliance specialists, and IoT innovators to discuss what the CRA actually means in practice, where companies are falling behind, and what needs to happen now to prepare.

We’ll explore the operational, technical, and organisational gaps that are preventing businesses from becoming CRA-ready, including secure development practices, vulnerability management, SBOMs, supply chain visibility, post-market obligations, and product accountability.

Whether you’re building connected devices, managing product security, navigating compliance requirements, or advising organisations on cyber risk, this event is designed to spark honest conversations about the current state of readiness across the industry.

09:30 – Registration
10:00 – Keynotes: HMG CyberSec Representative / TUV Representative : CRA competitive impact for the UK
10:30 – Session 1 : The Business impacts of CRA (What, Why, How & When?)
Richard Marshall, CENELEC JTC13/WG9 & BSI IST/33/-/9 Chair – The CRA Roadmap; What to expect
Simon Dunkley, Itron and BSI IST/33/-/8 Chair (EN 18031) – The challenge ahead for OEMs based upon the RED Article 3.3
11:20 – Coffee Break
11:40 – Haydn Povey, SCI Semi – Building in Cyber Resilience
12:00 – TBC – Certification and global compliance
12:30 – Lunch & Networking
13:30 – Session 2 : IoTSF Plenary and CRA Action Plan (Where is IoTSF now & how can we address the opportunity)
TBC – How can IoTSF support the OEM sector? (What have we done before?)
Panel Discussion with audience Q&A : TuV, Element, ITRON
14:15 – Coffee break
14:35 – Session 3: IoTSF forward activity plan
Assurance Framework Group
Best Practice Group
Regulatory Watch Group
15:50 – AOB and Wrap-up
16:00 – Event close