Reducing Compliance Complexity: A Unified OCP Safe and SESIP Path to CRA

Author: Format Amaro, General Manager, HGS / Brightsight by SGS, Barcelona/Madrid Collection: 2026-OCP-EMEA-Summit-Executive-Sessions

Summary

This presentation from Brightsight (an SGS company) maps two established security evaluation frameworks — OCP S.A.F.E. (Security Appraisal Framework and Evaluation) and SESIP (Security Evaluation Standard for IoT Platforms) — against the EU Cyber Resilience Act (CRA), which becomes mandatory at end of 2027. The core argument is that companies already pursuing OCP S.A.F.E. evaluation for their data center components can reuse a substantial portion of that work to satisfy CRA conformity requirements, reducing duplication and cost while accelerating time to market.

The CRA imposes 14 essential requirements on products (secure-by-design, no known exploitable vulnerabilities, secure-by-default, security updates, access control, data confidentiality/integrity/availability, basic functionality despite incidents, minimization of attack surface, incident mitigation, recording/monitoring, deletion of data) and 8 requirements on vulnerability handling (identifying/documenting, addressing, regular security testing, publishing fixed vulnerabilities, vulnerability disclosure policy, third-party reporting, ensuring secure distribution of updates, and disseminating updates). Products fall into four conformity categories: Default (90% of products, self-assessment Module A), Important Class I (3rd-party Module B+C or H), Important Class II (3rd-party, including hypervisors/firewalls/tamper-resistant microprocessors), and Critical (EUCC with delegated act).

OCP S.A.F.E. maps directly to the product-side requirements through its scoping phase (risk assessment and essential requirements coverage) and SRP assessment phase (conformity assessment and technical documentation). The lifecycle/vulnerability-handling requirements are the gap that must be filled by non-OCP means. Brightsight's competitive position is that it operates simultaneously as an ITCF SRP lab (for OCP evaluations) and as a CRA Notified Body (NoBo), enabling reuse of OCP evaluation evidence without re-work. SESIP follows an identical flow, with the additional advantage of pre-defined profiles for common IoT device categories and sector-specific mappings to IEC 62443 (industrial) and ISO 21434 (automotive).