{"id":8310,"date":"2026-09-11T06:37:58","date_gmt":"2026-09-11T04:37:58","guid":{"rendered":"https:\/\/www.scs.ch\/uncategorized-en-us\/cybersecurity-analysis-for-a-sanitary-product-according-to-the-radio-equipment-directive\/"},"modified":"2026-09-20T07:38:54","modified_gmt":"2026-09-20T05:38:54","slug":"cybersecurity-analysis-for-a-sanitary-product-according-to-the-radio-equipment-directive","status":"publish","type":"post","link":"https:\/\/www.scs.ch\/en\/case-studies\/cybersecurity-analysis-for-a-sanitary-product-according-to-the-radio-equipment-directive\/","title":{"rendered":"Cybersecurity Analysis for a Sanitary Product According to the Radio Equipment Directive"},"content":{"rendered":"

Initial Situation<\/h2><\/div>

Since August 2025, additional cybersecurity requirements of the Radio Equipment Directive have applied to certain radio equipment. This can also affect connected devices in industry and building technology that were previously not subject to any cybersecurity standards. The embedded device under investigation has a radio interface and processes personal data. According to the RED, it is therefore considered radio equipment connected to the internet. For the analysis, the requirements from EN 18031-1 for network protection and EN 18031-2 for the protection of personal data were therefore relevant. <\/p>\n<\/div>

\"\"<\/span><\/div><\/div><\/div>

Project Overview<\/h3><\/div>

Client<\/strong>
Manufacturer of sanitary products<\/p>\n<\/div>

<\/div><\/div>

Sector<\/strong>
Cybersecurity & Reliability<\/p>\n<\/div>

<\/div><\/div>

Solution<\/strong>
Cybersecurity analysis of a connected device according to EN 18031.<\/p>\n<\/div>

<\/div><\/div>

System Environment <\/strong>
Embedded device with radio interface, processes personal data<\/p>\n<\/div>

<\/div><\/div>

Tested Standard Parts <\/strong>
EN 18031-1 (Network Protection) and EN 18031-2 (Protection of Personal Data)<\/p>\n<\/div>

<\/div><\/div>

Approach<\/strong>
Applicability, risk analysis, testing of security mechanisms, assessment of adequacy<\/p>\n<\/div><\/div><\/div><\/div><\/div>

The Contribution of SCS<\/h2><\/div>

SCS systematically tested the product together with the client and their development partner according to EN 18031. Predefined SCS templates guided the process from applicability and risk analysis to the evaluation of existing security mechanisms. <\/p>\n<\/div><\/div><\/div>

<\/i><\/div>

Applicability Clarified<\/h4><\/div>
<\/div>
\n

First, SCS clarified which parts of the series of standards were relevant for the product. In this specific case, EN 18031-1 for network protection and EN 18031-2 for personal data were decisive. EN 18031-3 for fraud protection was not applicable. <\/p>\n<\/div><\/div><\/div>

<\/i><\/div>

Risks Systematically Analyzed<\/h4><\/div>
<\/div>
\n

In a workshop, SCS, the client, and the development partner first identified the assets worthy of protection. Subsequently, possible vulnerabilities were analyzed and the resulting risks were assessed and quantified. <\/p>\n<\/div><\/div><\/div>

<\/i><\/div>

Security Mechanisms Tested<\/h4><\/div>
<\/div>
\n

SCS tested security mechanisms such as access control, authentication, and software updates based on the decision logic defined in EN 18031. Where gaps existed, SCS developed concrete approaches for implementation in compliance with the standard. <\/p>\n<\/div><\/div><\/div>

<\/i><\/div>

Adequacy of Implementation Verified<\/h4><\/div>
<\/div>
\n

Finally, SCS assessed whether the intended cybersecurity measures were implemented sufficiently and appropriately for the specific application purpose (referred to in EN 18031 as functional sufficiency).<\/p>\n<\/div><\/div><\/div>

<\/div><\/div><\/div><\/div><\/div><\/div>
<\/div>

Result<\/h2><\/div>

The client received a precise overview of which RED requirements were relevant for their product, which security mechanisms were already sufficiently implemented, and where further action was required. The detailed analysis documented risks, relevant mechanisms according to EN 18031, and their conceptual assessment, thereby creating a reliable basis for the next development steps. The result was positive. Cybersecurity was already part of product development at the manufacturer and its development partner from the very beginning. This security-by-design approach was reflected accordingly in the analysis. <\/p>\n<\/div><\/div><\/div>

EN 18031-1 & -2<\/h3><\/div>

relevant standard parts for network and data protection.<\/p>\n<\/div><\/div><\/div>

5 Steps<\/h3><\/div>

from applicability to assessment of implementation.<\/p>\n<\/div><\/div><\/div>

Security by Design<\/h3><\/div>

Cybersecurity already considered during product development.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

Services Provided<\/h2><\/div><\/div><\/div>

Information Security<\/h3><\/div><\/div><\/div><\/div><\/div><\/div>

Cybersecurity Analysis \/ RED & CRA<\/h3><\/div><\/div><\/div><\/div><\/div><\/div>

Cybersecurity & Reliability<\/h3><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>
\"A<\/div><\/div>

Your Contact Person<\/h2><\/div>
Dr. Stephan Keller<\/div><\/div>

Chief Executive Officer
+41 43 456 16 80<\/a><\/p>\n<\/div>

Speak with the responsible specialist<\/span>Speak with the responsible specialist<\/span><\/div><\/a><\/div>

For questions regarding cybersecurity analyses, the Radio Equipment Directive, and the Cyber Resilience Act.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>

Further Case Studies<\/h2><\/div>