Chapter 4 of 8

4Technology and architecture

22 min read · 14 figures · 3 tables · 106 sources

A connected product meets the device requirements of the five acts in six technical layers between the radio chip and the ERP system, and no single layer covers a whole act. Most components are available certified, among them secure elements, microcontrollers with one of 316 PSA certifications, and update and certificate services. The gaps are processes no vendor sells, namely factory provisioning, a security team that meets the 24-hour reporting clock and an update mechanism that lasts the whole support period. The chapter takes the layers from the radio up, maps the obligations of the acts onto them and combines them into one reference architecture per archetype.

4.1 Connectivity

The radio decides how long a product can be reached for updates. The last 2G networks in Germany and Austria close in 2028, inside the support period of a product launched in 2027.6, 77 Telekom aims for 30 June 2028, Vodafone for September 2028 with some critical IoT use until 2030, and Telefónica for the end of 2028.77 A1 in Austria plans for 31 May 2028.6 3G is already off in all three countries, and Switzerland has closed 2G as well.47, 373, 413 The Cyber Resilience Act (CRA) asks for updates over the whole support period.171 A radio that disappears before then becomes a compliance risk. New designs need no 2G fallback; fleets with 2G modules need a migration plan.

LTE-M and NB-IoT are the low-power cellular options with national coverage and no announced end date. Telekom completed nationwide LTE-M in July 2020.94 At the end of 2020 Vodafone’s LTE-M covered more than 90 % and its NB-IoT more than 97 % of Germany’s land area.408 LTE-M handles mobility and firmware images, while NB-IoT reaches deeper indoors. A system-in-package such as the Nordic nRF9151 sleeps at 2.7 µA in power saving mode (PSM).284 5G RedCap (3GPP Release 17)5 is the successor for devices that need more bandwidth. Its market is young, as Germany’s first commercial RedCap product was a smartwatch in September 2025.95 For 2027 RedCap is therefore an option for the machine gateway, not a default.

Three further networks belong to the customer or the utility, not to the device maker. The Federal Network Agency (BNetzA) has assigned 3.7-3.8 GHz for local 5G campus networks since November 2019, from a base fee of €1,000.80 By November 2025 it had issued 484 assignments in that band,75 against 27 in the 26 GHz band.76 The 450 MHz band went to 450connect in 2021 for energy and water,73 assigned until 31 December 2040,72 and carries smart meter traffic. LoRaWAN (ITU-T Y.4480)254 runs below a 1 % duty cycle at 868 MHz.84 Firmware updates are therefore limited to small deltas. Germany has no nationwide public LoRaWAN network. Netze BW alone runs up to 3,000 gateways.255

At short range the law shapes pairing more than the radio. Bluetooth Low Energy (BLE) offers LE Secure Connections41 and, since Core 6.0, Channel Sounding for ranging.42 EN 18031-1 gives no presumption of conformity where the user may choose not to set any password.148 “Just Works” pairing therefore cannot be the only protection for a tool that accepts commands. New Wi-Fi CERTIFIED devices have required WPA3 since 2020.411 Galileo’s navigation message authentication (OSNMA) has been in service since 24 July 2025 and lets a tracker detect spoofed positions.176

4.2 Device security layer

The device security layer carries most of the security properties the CRA requires of the product.171 Access protection, confidentiality, integrity and exploit mitigation all depend on it. It is also the layer most fully available as certified parts. It further carries the Machinery Regulation’s duty to protect safety-relevant software against corruption and to collect evidence of intervention.168

Keys sit either in a discrete secure element or trusted platform module (TPM), or in an isolated region of the main microcontroller. Five of seven common parts carry a Common Criteria (CC) certificate (Table 7). NIST has listed FIPS 140-2 certificates as historical since September 2026. They still cover deployed modules. New procurement that asks for FIPS, however, needs FIPS 140-3, which the TA100’s successor TA101 holds at Level 2.261, 276, 277, 278 The ATECC608B has no certificate, and Microchip lists one of its variants as not recommended for new designs.263 A TPM 2.0394 suits a Linux gateway with measured boot, a secure element a microcontroller device.

Component Vendor Certification Provisioning option
EdgeLock SE050 NXP CC EAL6+ up to OS level; FIPS 140-2 level 3 for the SE050F variant (historical since September 2026) EdgeLock 2GO
EdgeLock SE051 NXP CC EAL6+ with AVA_VAN.5; IEC 62443-4-2 certified for applicable requirements EdgeLock 2GO
OPTIGA Trust M Infineon CC EAL6+ Trust M Express, pre-registered for AWS IoT and Azure IoT Hub
ATECC608B Microchip No CC or FIPS certificate Trust&GO (pre-provisioned, MOQ 10), TrustFLEX, TrustCUSTOM
TA100 Microchip FIPS 140-2 level 2 (historical since September 2026; successor TA101: FIPS 140-3 level 2); AEC-Q100 grade 1 TrustFLEX / custom
STSAFE-A110 ST CC EAL5+ AVA_VAN.5 ST personalisation service
OPTIGA TPM SLB9672 Infineon TPM 2.0; CC EAL4+ AVA_VAN.4 (BSI-DSZ-CC-1277-2026); FIPS 140-2 level 2 (historical since September 2026) Pre-installed endorsement key
Table 7: Certification of common secure elements and TPMs

Sources: [51, 217, 218, 297, 298, 368].

The PSA Certified level is the evidence that counts where keys stay on the microcontroller. The PSA Certified database holds 316 certifications from 123 companies, among them Level 3 for the STM32U585, NXP MCX N94x/N54x and Silicon Labs EFR32MG21B.326 On Armv8-M parts, TrustZone isolates a secure partition. Trusted Firmware-M is the reference implementation.395 Level 2 shows in a 25-day lab evaluation that the root of trust resists software attacks; Level 3 extends that to substantial hardware attacks.325 Both build on the SESIP method of GlobalPlatform, which took over PSA Certified in September 2025.194 SESIP is published as EN 17927:2023.83 The Nordic nRF54L15, which Nordic markets as designed for Level 3, was certified at Level 1 in January 2026.326 The certificate pays off as reuse. NXP shows how a manufacturer can carry a chip’s security target into EN 18031 and IEC 62443-4-2 evidence.295

A design built to IEC 62443 and EN 18031 yields such reusable evidence, but not yet a presumption of conformity under the CRA. The CRA’s 41 harmonised standards are still being written under standardisation request M/606, and none is cited in the Official Journal.151 The EN 18031 series under the Radio Equipment Directive (RED), by contrast, has been cited with restrictions since January 2025.145, 148 IEC 62443-4-1 sets the development process,208 IEC 62443-4-2 the component requirements,117, 209 and ETSI EN 303 645 the consumer IoT baseline.135

Secure boot closes the layer. MCUboot is the common open-source bootloader for 32-bit microcontrollers.258 Linux gateways use U-Boot verified boot with a TPM-measured chain. Updates follow the architecture of RFC 9019214 with a signed manifest per RFC 9124.215 The bootloader checks the signature against a key in the root of trust, refuses a downgrade and falls back to the old slot if the new image fails. This meets two CRA duties, the secure distribution of updates and automatic security updates by default.171

4.3 Device management and PKI

Update services are easy to buy, but each device’s identity is not. It has to be in place before the device leaves the factory. Five services carry most DACH projects in 2026: Mender for embedded Linux and microcontrollers,292 Memfault with crash reporting,260 Golioth billed per active device,199 AWS IoT Device Management with signed FreeRTOS jobs20 and Azure Device Update, which stays generally available while Microsoft previews a successor.267 Microsoft’s edge platform, Azure IoT Operations, brings its own MQTT broker.269 Prices and owners of these services changed in 2025 and 2026. Memfault is now part of Nordic, and Golioth part of Canonical.198, 286 The update service therefore belongs behind an abstraction, and an open on-device format such as MCUboot images keeps the vendor replaceable.

Every device needs a unique credential, because the CRA asks for secure-by-default configuration171 and EN 18031 rules out universal default passwords.148 There are three routes:

  1. Pre-provisioned secure elements. The chip vendor signs the birth certificate: Microchip Trust&GO from 10 units,263 Infineon Trust M Express,218 NXP EdgeLock 2GO.296
  2. In-line provisioning at end-of-line test. A station with a hardware security module signs each device’s request with the manufacturer’s own issuing CA, using services such as DigiCert, Keyfactor EJBCA or GlobalSign.105, 195, 232
  3. First-connect provisioning. AWS fleet provisioning by claim21 or the Azure Device Provisioning Service.268 It is the cheapest route. Its weakest link is the shared claim credential.

Certificate lifetime is a design decision. A birth certificate for the product life plus short-lived operational certificates renewed over EST212 limits the damage of a stolen key. BRSKI adds zero-touch bootstrap.213 Short lifetimes are also cheaper. AWS Private CA costs USD 50 a month in short-lived mode against USD 400 in general-purpose mode.19

4.4 SBOM and PSIRT tooling

Tools cover three of the CRA’s eight vulnerability-handling duties, namely the software bill of materials (SBOM), testing and disclosure.171 The update service covers two more. Only a product security incident response team (PSIRT) can do the rest. Since 11 September 2026 that team must send an early warning within 24 hours of an actively exploited vulnerability, a notification within 72 hours and a final report within 14 days of a fix, also for products already on the market.171 ENISA’s Single Reporting Platform opened the same day and sends each report to the coordinating CSIRT and ENISA at once.133

The formats are settled. CycloneDX is ECMA-424120 and SPDX is ISO/IEC 5962.253 Technical Guideline TR-03183-2 of the Federal Office for Information Security (BSI), dated August 2025, is the most specific profile: CycloneDX 1.6 or SPDX 3.0.1 or later, a SHA-512 hash per component, and no vulnerability information in the SBOM itself.50 Advisories go out separately as CSAF 2.0, whose VEX profile states whether a product is affected.302 Version 2.1 was in draft in September 2026.303 BSI’s CERT-Bund itself publishes as a CSAF trusted provider.52 CSAF advisories therefore reach German customers through a channel they already read.

OWASP Dependency-Track is free and matches SBOMs against vulnerability feeds continuously.321 Bought-in firmware without source, such as radio modules, needs binary analysis, offered for example by ONEKEY in Düsseldorf.308 No tool supplies the other parts of a PSIRT: a named team, a published contact, triage with VEX statements and a release path into the update service.

4.5 Data interfaces for the Data Act

The Data Act asks for access by design but names no protocol. For device makers the hard part is therefore authorisation, not format. Products placed on the market since 12 September 2026 must make readily available data accessible to the user “by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format”.170 Articles 4 and 5 add access on request and access for third parties the user names.170 The Commission’s FAQ of January 2026 counts data stored even temporarily as readily available, but does not require direct access in every situation.158

Four open interfaces meet the test in DACH industry. OPC UA (IEC 62541)211 can publish over MQTT,312 and umati builds on the VDMA’s machinery specification for it.398 MQTT 5.0 is an OASIS Standard.301 The Asset Administration Shell (IEC 63278-1),210 at version 3.2 in IDTA Release 26-01,216 holds static product data and points to live data. A documented REST API serves users and third parties in the cloud.

Third-party access must be scoped to one user’s products and revocable. The manufacturer reuses the identity layer for this. The device certificate identifies the product, and an OAuth-style grant ties it to the user. The data leaving the product falls under the CRA’s confidentiality and data minimisation duties.171

4.6 Obligations by layer

The secure device and the PKI carry more of the law than any other layer. They are also the two that a firmware update cannot add later. The CRA, the RED, the Machinery Regulation and the Data Act each need at least five of the six layers (Table 8).

Layer CRA, properties (Annex I Part I) CRA, processes (Annex I Part II) RED Machinery Regulation Data Act
Connectivity (2)(h) availability, (2)(i) impact on networks; reachability for (2)(c) (7) update channel over the support period Art. 3(3)(d) network protection; secure pairing 1.2.1(a) resistance to malicious attempts on the link Transport of data to user and third party
Secure device (2)(d) access, (2)(e) confidentiality, (2)(f) integrity, (2)(k) exploit mitigation (7) signature check of updates Art. 3(3)(d), (e), (f): authentication, secure storage 1.1.9 protection against corruption, evidence of intervention Device identity behind each data set
Device management and OTA (2)(c) automatic security updates, (2)(l) logging (2) remediation, (7) secure distribution, (8) free updates Update mechanism, logging 1.1.9 evidence of software intervention Remote configuration of data access
Certificates and PKI (2)(b) secure by default, (2)(d) authentication (7) code-signing keys No universal default passwords; credential management 1.2.1(a) authenticated control commands Authorisation of third parties
SBOM and PSIRT (2)(a) no known exploitable vulnerabilities (1) SBOM, (3) tests, (4) disclosure, (5) CVD, (6) contact; Art. 14 24 h / 72 h / 14 days Vulnerability handling for radio stacks Supplier software evidence n/a
Data interfaces (2)(e) confidentiality, (2)(g) data minimisation, (2)(m) deletion n/a Art. 3(3)(e) privacy n/a Art. 3(1) access by design, Art. 4 access on request, Art. 5 third parties
Table 8: Legal requirements by layer

Note: An entry means the layer carries the technical measure, not that buying the layer produces conformity. Sources: [141, 148, 168, 170, 171].

Vulnerability handling under the CRA is mostly process. Without a PSIRT the reporting clock cannot be met, whatever tools are in place.133, 171 The Data Act, by contrast, needs neither a new radio nor a new chip. It adds an authorisation layer on top of the device identity the CRA already demands.

4.7 Four reference architectures

The four archetypes share one backbone and differ only where physics or regulation forces them to. The backbone has five elements:

  • Every device holds a unique key in a root of trust and a factory-issued certificate.
  • Every image is signed and checked before it runs.
  • One update service serves all product lines.
  • One PSIRT serves all products and reports through ENISA’s Single Reporting Platform.133
  • Every product exposes its data through a documented interface.170

4.7.1 Battery tool with BLE tracker

The battery tool carries no cellular modem and reaches the cloud only through the user’s phone or a site gateway. Its security therefore sits in the BLE chip, and its updates travel through a courier it does not trust (Figure 5).

BLE Secure ConnectionsBLE advertisingsigned imagerelay onlyBattery tool: BLE SoC withTrustZone, secure boot, devicekeySmartphone appSite or van gateway: BLE toLTE-MDevice cloud: identity, OTA,data APIERP: fixed assets, rental andservice ordersData Act access for user andthird partiesPSIRT with SBOM and VEXCSIRT and ENISA reportingplatform
Figure 5: Reference architecture: battery tool with BLE tracker
Radio
Bluetooth LE with LE Secure Connections. Lock, unlock and torque commands come only from an authenticated app session.
Gateway
The user’s phone, or a BLE-to-LTE-M gateway in the van, site container or tool crib. Every advertising packet carries a rotating, encrypted identifier.
Platform
A device cloud for microcontroller fleets that registers identities from the factory manifest, keeps the ownership record and serves the data API.
ERP
Event-driven posting of last-seen location, usage hours, charge cycles and fault codes. The ERP never polls tools.
Update mechanism
Signed image relayed by the app. The bootloader checks signature and version and keeps the old image until the new one boots.
Reporting path
SBOM of BLE stack and application from the build, with the radio vendor’s SDK as a third-party component, and a CSAF advisory with VEX.

Cost. In our cost model the battery tool comes to €0.50 per device per month in the base case, the lowest of the four archetypes. Of this, €0.47, or 93 %, is the security premium. Signed OTA on Golioth is about half of that premium.199

What to watch. Pairing must make the user set a credential, as the password rule of EN 18031 requires.148 PSA Level 3 evidence has to be checked in the certification registry, not in the datasheet.326 For the battery tool, automatic security updates by default depend on an app the user opens.171 The update service must therefore track which tools have not been in range. The site gateway is a radio product with CRA and RED duties of its own.

4.7.2 Machine with gateway

The machine’s gateway reads the control system but has no write path to the safety controller (Figure 6). That separation carries the protection the Machinery Regulation requires against “reasonably foreseeable malicious attempts from third parties leading to a hazardous situation”.168

OPC UA read onlyno write pathcustomer LAN or 5G campusLTE-M or RedCap fallbacksigned packagessigned PLC firmware withaudit logMachine control: PLC anddrivesEdge gateway: Linux, TPM 2.0,A/B updateSafety controllerCustomer networkManufacturer platform: identity,OTA, data APIERP: service orders, spareparts, consumptionData Act: OPC UA, AAS, RESTAPIPSIRT with SBOM and VEXCSIRT and ENISA reportingplatform
Figure 6: Reference architecture: machine with gateway
Radio
The customer’s network first (Ethernet, Wi-Fi with WPA3 or a 5G campus network). Cellular with an eSIM as the fallback, over LTE-M, or RedCap for video and large logs. No 2G or 3G.
Gateway
Linux edge gateway with TPM 2.0, measured boot and an A/B root file system. It reads the control system over OPC UA and signs an audit log of every change.
Platform
Azure IoT Hub with Device Update, AWS IoT Core with Device Management jobs, or self-hosted Mender.
ERP
Condition events become service orders, consumption data spare-part proposals or usage-based billing. The customer’s ERP receives the same events through the Data Act interface.
Update mechanism
Gateway packages and PLC firmware are signed separately. PLC firmware waits for a maintenance window, and security fixes travel on their own channel.
Reporting path
SBOM to BSI TR-03183-2 for several hundred Linux packages, binary analysis of supplier firmware and CSAF advisories pushed to customers.

Cost. For the machine we calculate €3.10 per device per month in the base case, the highest of the four archetypes. The cellular tariff and always-on cloud traffic drive the total. The security premium of €0.40 is 13 % of it.

What to watch. The audit log on device and platform supplies the evidence of intervention in the software that the Machinery Regulation requires.168 PLC firmware is a safety-relevant change. The CRA asks for security updates to be separated from functionality updates where technically feasible.171 The customer can then accept fixes without requalifying the process. A Class I gateway sold on its own needs a notified body as long as no CRA harmonised standard is cited in the Official Journal.171 It should be designed to IEC 62443-4-2.209 Certified parts for it exist, such as the NXP SE051298 or the SLB9672 TPM, certified until 2031.51

4.7.3 Building device under § 14a

The building device takes grid control through the metering point operator’s smart meter gateway and control box, never through the manufacturer’s cloud.74, 403 The maker therefore designs an EEBUS interface and keeps the cloud path separate from it (Figure 7).

EEBUS SHIP and SPINE, LPCCLS channel, TLSWAN: LTE or 450 MHzEEBUScustomer Wi-Fisigned imageHeat pump or wallboxcontroller with secure elementFNN control boxSmart meter gateway to BSITR-03109Grid operator and externalmarket participantOptional home energymanagement systemManufacturer cloud: identity,OTA, app, data APIERP: installation base,warranty, serviceData Act access for user andthird partiesPSIRT with SBOM and VEXCSIRT and ENISA reportingplatform
Figure 7: Reference architecture: building device under § 14a EnWG
Radio
Not the maker’s choice on the grid side, where the smart meter gateway uses public mobile networks or 450 MHz. The device’s own link is the customer’s Wi-Fi.
Gateway
Smart meter gateway to BSI TR-03109 and an FNN control box. The device accepts EEBUS where available and has a relay input as the fallback.
Platform
Manufacturer cloud over the customer’s Wi-Fi for app, diagnosis, updates and Data Act access. It carries no grid control.
ERP
Commissioning creates the installation-base record that anchors warranty, recalls and security updates. Service events post as service orders.
Update mechanism
Signed images, automatic by default with an opt-out, never during an active control period. Minimum power and response time are checked after every update.
Reporting path
As for the other archetypes, plus coordinated disclosure with the EEBus Initiative and control-box vendors, since a flaw in the EEBUS stack reaches other makers’ devices.

Cost. For the building device we arrive at €0.59 per device per month in the base case. Of this, €0.48, or 81 %, is the security premium.

What to watch. A throttled device keeps at least 4.2 kW under BNetzA determination BK6-22-300, in force since 1 January 2024.74 A control signal must take effect within five minutes, and devices under old agreements move to the new regime by 1 January 2029.74 The customer gets a reduced grid fee in return,61 with a time-variable option since 1 April 2025.79 The control chain is not in the maker’s hands. It consists of the smart meter gateway,53 its WAN73 and a control box to the FNN specification of August 2025, covered by BSI TR-03109-5.49, 403 Control boxes offer EEBUS and relay contacts.93 The rollout target for these metering points is 90 % only by the end of 2032.60 The relay fallback therefore stays necessary for years. EEBUS (VDE-AR-E 2829-6)402 pairs devices by their certificate’s key identifier, confirmed by a person.123 The device therefore keeps its EEBUS key in protected storage and shows the identifier on display or label.

4.7.4 Logistics tracker

The logistics tracker is a battery budget with a radio attached. LTE-M with power saving carries it on the road, a BLE site gateway on site, and one tracker identity links both paths (Figure 8). The radio transmission, not sleep or GNSS, decides how long the cell lasts.

on site: BLEon the road: LTE-M with PSMsigned delta imageTracker: LTE-M and NB-IoT SiP,GNSS, Wi-Fi scan, BLE, secureelement, primary cellSite gatewayMobile network, eSIMTracking platform: identity,OTA, location solver, data APILocation service: cell, Wi-Fi,GNSS assistanceERP and TMS: goodsmovements, delivery eventsData Act access for user andthird partiesPSIRT with SBOM and VEXCSIRT and ENISA reportingplatform
Figure 8: Reference architecture: logistics tracker
Radio
LTE-M as the primary bearer for mobility and handover, NB-IoT as the deep-indoor fallback. An eSIM whose operator profile can be changed in the field.
Gateway
None on the road, and on site the BLE gateway of the battery tool. The track stays continuous because it is keyed on the tracker’s certificate, not on the bearer.
Platform
The common backbone plus geofences and a location solver behind an interface the manufacturer controls.
ERP
Geofence entries and exits post as goods-movement or delivery events to the ERP or transport management system. Raw positions stay in the platform.
Update mechanism
Signed delta images over LTE-M, only when stationary, in good coverage and above a battery threshold.
Reporting path
As for the other archetypes, plus the cellular modem firmware as a separate SBOM component that can be updated on its own.

Cost. For the tracker we calculate €0.99 per device per month in the base case, of which €0.46, or 46 %, is the security premium.

What to watch. The positioning chain decides the battery. A motion sensor decides whether a fix is needed. The cloud solves a Wi-Fi scan to under 100 m and a cell scan to under 700-1,000 m.287 GNSS at about 25 mW397 runs only when the asset moves. The nRF9151 draws 18 µA in LTE-M with extended discontinuous reception (eDRX).288 An eSIM under GSMA SGP.32 lets a trailer change operator without opening a sealed housing.202 Sleep and hourly GNSS fixes use about 3 % of a D-size cell of 17 Ah a year (Table 9). An A-size cell, by contrast, holds only 3.6 Ah.340

Item Calculation Charge per year (mAh)
Sleep in PSM 2.7 µA × 8,760 h 24
GNSS, one fix per hour 25 mW × 30 s assumed per fix = 0.75 J; at 3.6 V about 0.058 mAh per fix × 8,760 fixes 507
LTE-M report, one per hour Charge per transmission depends on network and coverage measure in the field
Capacity of an LS 33600 17 Ah nominal 17,000
Table 9: Annual charge budget of the logistics tracker

Sources: [284, 341, 397].

No datasheet gives the charge per LTE-M report. It depends on coverage and on how long the modem stays connected before it returns to PSM. It therefore has to be measured on the target network, in good and in poor coverage. The cell loses less than 1 % a year to self-discharge in storage at +20 °C.341 Its 17 Ah are rated at 5 mA, +20 °C and a 2.0 V cut-off, and at low temperature and higher current it delivers less.341 The manufacturer therefore sizes the cell with Saft for the coldest operating temperature and the real pulse profile, not for the nominal figure.

From 18 February 2027 the Battery Regulation requires portable batteries to be removable by the end user.150, 169 The manufacturer therefore checks whether an exception applies before designing a sealed housing. Semtech closed its LoRa Cloud geolocation service on 31 July 2025.355 The location solver therefore belongs behind the manufacturer’s own interface. Galileo OSNMA authenticates the position where it serves as evidence for customs or insurance.176

In summary

Taken together, the bottleneck is not the technology but the manufacturer’s own organisation. A manufacturer that fixes the root of trust and the backbone once for all product lines runs the PSIRT and the update mechanism only once and builds every further product on them. The next chapter shows where logistics tracking departs from this design.

Sources in this chapter106

Numbered as in the full reference list and the PDF.

  1. [5] 3GPP. (2023). A glimpse into RedCap NR devices. https://www.3gpp.org/technologies/nr-redcap-glimpse
  2. [6] A1 Digital. (2026). 2G network sunset announcement. https://www.a1.digital/news/2g-network-sunset-announcement/
  3. [19] Amazon Web Services. (2026). AWS Private CA pricing. https://aws.amazon.com/private-ca/pricing/
  4. [20] Amazon Web Services. (2026). FreeRTOS over-the-air updates. https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ota-dev.html
  5. [21] Amazon Web Services. (2026). Provisioning devices that don’t have device certificates using fleet provisioning. https://docs.aws.amazon.com/iot/latest/developerguide/provision-wo-cert.html
  6. [41] Bluetooth SIG. (2017). Bluetooth pairing part 4: LE Secure Connections. https://www.bluetooth.com/blog/bluetooth-pairing-part-4/
  7. [42] Bluetooth SIG. (2024). Bluetooth Channel Sounding. https://www.bluetooth.com/press/bluetooth-channel-sounding/
  8. [47] Bundesamt für Kommunikation BAKOM. (2025). 3G and 2G shutdown. https://www.bakom.admin.ch/en/3g-and-2g-shutdown
  9. [49] Bundesamt für Sicherheit in der Informationstechnik. (2023). FAQ: Anwendungsbereich der BSI TR-03109-5 (Kommunikationsadapter). https://bsi.bund.de/DE/Service-Navi/FAQ/TR-03109-5/faq_03109-5_node.html
  10. [50] Bundesamt für Sicherheit in der Informationstechnik. (2025). BSI TR-03183-2: Cyber Resilience Requirements for Manufacturers and Products, Part 2: Software Bill of Materials, Version 2.1.0. https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr03183/TR-03183_node.html
  11. [51] Bundesamt für Sicherheit in der Informationstechnik. (2026). Certification report BSI-DSZ-CC-1277-2026, Infineon OPTIGA TPM SLB9672. https://sec-certs.org/cc/ad5e2081def39258/
  12. [52] Bundesamt für Sicherheit in der Informationstechnik. (2026). CSAF provider metadata of CERT-Bund. https://wid.cert-bund.de/.well-known/csaf/provider-metadata.json
  13. [53] Bundesamt für Sicherheit in der Informationstechnik. (2026). Das Smart-Meter-Gateway: Cyber-Sicherheit für die Digitalisierung der Energiewende. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Broschueren/Smart-Meter-Gateway.pdf
  14. [60] Bundesministerium der Justiz. (2025). § 45 Messstellenbetriebsgesetz: Rollout targets. https://www.gesetze-im-internet.de/messbg/__45.html
  15. [61] Bundesministerium der Justiz. (2026). § 14a Energiewirtschaftsgesetz: Netzorientierte Steuerung von steuerbaren Netzanschlüssen und steuerbaren Verbrauchseinrichtungen. https://www.gesetze-im-internet.de/enwg_2005/__14a.html
  16. [72] Bundesnetzagentur. (2020). Entscheidung der Präsidentenkammer vom 16. November 2020 über die Vergabe von Frequenzen im Bereich 450 MHz für den drahtlosen Netzzugang (Vergabe- und Ausschreibungsregeln), BK1-20/001. https://www.bundesnetzagentur.de/SharedDocs/Downloads/DE/Sachgebiete/Telekommunikation/Unternehmen_Institutionen/Frequenzen/OffentlicheNetze/450MHZ/Praesidentenkammerentscheidung450MHz.pdf?__blob=publicationFile&v=2
  17. [73] Bundesnetzagentur. (2021). Erfolgreiche Bewerbung der 450connect GmbH. https://www.bundesnetzagentur.de/SharedDocs/Pressemitteilungen/DE/2021/20210309_450Mhz.html
  18. [74] Bundesnetzagentur. (2023). Festlegung BK6-22-300, Anlage 1: Netzorientierte Steuerung steuerbarer Verbrauchseinrichtungen. https://www.bundesnetzagentur.de/DE/Beschlusskammern/1_GZ/BK6-GZ/2022/BK6-22-300/Beschluss/BK6-22-300_Beschluss_Anlage1.pdf
  19. [75] Bundesnetzagentur. (2025). Übersicht der Zuteilungsinhaber für Frequenzzuteilungen für lokale Frequenznutzungen im Frequenzbereich 3.700-3.800 MHz. https://www.bundesnetzagentur.de/SharedDocs/Downloads/DE/Sachgebiete/Telekommunikation/Unternehmen_Institutionen/Frequenzen/OffentlicheNetze/LokaleNetze/Zuteilungsinhaber3,7GHz.pdf
  20. [76] Bundesnetzagentur. (2025). Übersicht der Zuteilungsinhaber für lokale Frequenznutzungen im Frequenzbereich 24,25-27,5 GHz. https://www.bundesnetzagentur.de/SharedDocs/Downloads/DE/Sachgebiete/Telekommunikation/Unternehmen_Institutionen/Frequenzen/OffentlicheNetze/LokaleNetze/Zuteilungsinhaber26GHz.pdf
  21. [77] Bundesnetzagentur. (2026). 2G-Abschaltung. https://www.bundesnetzagentur.de/DE/Fachthemen/Telekommunikation/Breitband/2GAbschaltung/start.html
  22. [79] Bundesnetzagentur. (2026). Pressemitteilung zu Netzentgelten nach § 14a EnWG. https://bundesnetzagentur.de/SharedDocs/Pressemitteilungen/DE/2026/20260528_14a.html
  23. [80] Bundesnetzagentur. (2026). Regionale und lokale Netze. https://www.bundesnetzagentur.de/lokalesbreitband
  24. [83] CEN-CENELEC JTC 13. (2023). EN 17927:2023 Security Evaluation Standard for IoT Platforms (SESIP). https://iteh.es/catalog/standards/cen/e545f156-f87b-4463-a711-9483b31a202d/en-17927-2023
  25. [84] CEPT ECC. (2001). ERC Decision (01)04 on non-specific short range devices. https://docdb.cept.org/download/2369
  26. [93] Deutsche Energie-Agentur (dena). (2025). Factsheet CLS-Einheit. https://www.dena.de/fileadmin/dena/Publikationen/PDFs/2025/FS_CLS-Einheit.pdf
  27. [94] Deutsche Telekom. (2020). Deutsche Telekom launches LTE-M in Germany. https://www.telekom.com/en/newsroom/latest-updates/media-information/2020/7/deutsche-telekom-launches-lte-m-in-germany
  28. [95] Deutsche Telekom. (2025). Nur bei der Telekom: Die neue Apple Watch funkt mit 5G. https://www.telekom.com/de/newsroom/aktuelles/medieninformationen/2025/09/nur-bei-der-telekom-die-neue-apple-watch-funkt-mit-5g
  29. [105] DigiCert. (2026). DigiCert Device Trust Manager. https://www.digicert.com/device-trust-manager
  30. [117] DIN. (2026). EN IEC 62443-4-2:2019/prAA, amendment for citation under the CRA. https://www.dinmedia.de/de/norm-entwurf/din-en-iec-62443-4-2-a1/
  31. [120] Ecma International. (2025). ECMA-424: CycloneDX Bill of Materials Specification, 2nd edition. https://ecma-international.org/publications-and-standards/standards/ecma-424/
  32. [123] EEBus Initiative. (2024). FAQs § 14a. https://www.eebus.org/wp-content/uploads/2024/04/FAQs-%C2%A7-14a.pdf
  33. [133] ENISA. (2026). The CRA Single Reporting Platform is launched. https://www.enisa.europa.eu/news/the-cra-single-reporting-platform-is-launched
  34. [135] ETSI. (2024). ETSI EN 303 645 V3.1.3 (2024-09): Cyber Security for Consumer Internet of Things: Baseline Requirements. https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf
  35. [141] European Commission. (2022). Commission Delegated Regulation (EU) 2022/30 supplementing Directive 2014/53/EU (RED) with regard to cybersecurity. https://eur-lex.europa.eu/eli/reg_del/2022/30/oj
  36. [145] European Commission. (2023). Commission Delegated Regulation (EU) 2023/2444 amending Delegated Regulation (EU) 2022/30 as regards the date of application. https://eur-lex.europa.eu/eli/reg_del/2023/2444/oj
  37. [148] European Commission. (2025). Commission Implementing Decision (EU) 2025/138 amending Implementing Decision (EU) 2022/2191 as regards harmonised standards for cybersecurity of radio equipment. http://data.europa.eu/eli/dec_impl/2025/138/oj
  38. [150] European Commission. (2025). Commission Notice C/2025/214: guidelines on Article 11 of Regulation (EU) 2023/1542. https://eur-lex.europa.eu/eli/C/2025/214/oj/eng
  39. [151] European Commission. (2025). Cyber Resilience Act: standardisation. https://digital-strategy.ec.europa.eu/en/policies/cra-standardisation
  40. [158] European Commission. (2026). Frequently asked questions on the Data Act, version 1.4. https://ec.europa.eu/newsroom/dae/redirection/document/108144
  41. [168] European Parliament and Council. (2023). Regulation (EU) 2023/1230 on machinery (Machinery Regulation). https://eur-lex.europa.eu/eli/reg/2023/1230/oj
  42. [169] European Parliament and Council. (2023). Regulation (EU) 2023/1542 concerning batteries and waste batteries (battery passport). https://eur-lex.europa.eu/eli/reg/2023/1542/oj
  43. [170] European Parliament and Council. (2023). Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act). https://eur-lex.europa.eu/eli/reg/2023/2854/oj
  44. [171] European Parliament and Council. (2024). Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). https://eur-lex.europa.eu/eli/reg/2024/2847/oj
  45. [176] EUSPA. (2025). From testing to operations: Galileo OSNMA service now available to users. https://www.euspa.europa.eu/newsroom-events/news/testing-operations-galileo-osnma-service-now-available-users
  46. [194] GlobalPlatform. (2025). PSA Certified now available with GlobalPlatform’s SESIP evaluation methodology. https://globalplatform.org/psa-certified-now-available-with-globalplatforms-sesip-evaluation-methodology/
  47. [195] GlobalSign. (2026). IoT Identity Platform. https://www.globalsign.com/en/internet-of-things/iot-identity-platform
  48. [198] Golioth. (2026). Golioth is now a part of Canonical. https://blog.golioth.io/golioth-is-now-a-part-of-canonical/
  49. [199] Golioth. (2026). Golioth pricing. https://golioth.io/pricing
  50. [202] GSMA. (2026). SGP.32 eSIM IoT Technical Specification. https://www.gsma.com/solutions-and-impact/technologies/esim/esim-specification/
  51. [208] IEC. (2018). IEC 62443-4-1:2018 Security for industrial automation and control systems, Part 4-1: Secure product development lifecycle requirements. https://webstore.iec.ch/en/publication/33615
  52. [209] IEC. (2019). IEC 62443-4-2:2019 Security for industrial automation and control systems, Part 4-2: Technical security requirements for IACS components. https://webstore.iec.ch/en/publication/34421
  53. [210] IEC. (2023). IEC 63278-1:2023 Asset Administration Shell for industrial applications, Part 1: Asset Administration Shell structure. https://webstore.iec.ch/en/publication/65628
  54. [211] IEC. (2025). IEC 62541-1:2025 OPC Unified Architecture, Part 1: Overview and concepts. https://webstore.iec.ch/en/publication/81513
  55. [212] IETF. (2013). RFC 7030: Enrollment over Secure Transport. https://www.rfc-editor.org/info/rfc7030
  56. [213] IETF. (2021). RFC 8995: Bootstrapping Remote Secure Key Infrastructure (BRSKI). https://www.rfc-editor.org/info/rfc8995
  57. [214] IETF. (2021). RFC 9019: A Firmware Update Architecture for Internet of Things. https://www.rfc-editor.org/rfc/rfc9019
  58. [215] IETF. (2022). RFC 9124: A Manifest Information Model for Firmware Updates in Internet of Things Devices. https://www.rfc-editor.org/rfc/rfc9124
  59. [216] Industrial Digital Twin Association. (2026). AAS specifications, Release 26-01. https://industrialdigitaltwin.org/en/content-hub/aasspecifications
  60. [217] Infineon Technologies. (2026). OPTIGA Trust M. https://www.infineon.com/OPTIGA-Trust-M
  61. [218] Infineon Technologies. (2026). OPTIGA Trust M Express. https://infineon.com/cms/en/product/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-trust/optiga-trust-m-express
  62. [232] Keyfactor. (2026). EJBCA Enterprise. https://www.keyfactor.com/products/ejbca-enterprise/
  63. [253] Linux Foundation SPDX. (2024). SPDX overview and release history. https://spdx.dev/about/overview/
  64. [254] LoRa Alliance. (2021). LoRaWAN approved as ITU-T Recommendation Y.4480. https://lora-alliance.org/?p=219640
  65. [255] LoRa Alliance. (2026). Netze BW: largest LoRaWAN deployment in Germany. https://lora-alliance.org/?p=598
  66. [258] MCUboot project. (2026). MCUboot documentation. https://docs.mcuboot.com/
  67. [260] Memfault. (2026). Memfault pricing. https://memfault.com/pricing/
  68. [261] Microchip Technology. (2020). Microchip TA100 automotive secure element. https://www.microchip.com/en-us/product/TA100
  69. [263] Microchip Technology. (2026). Trust Platform for the CryptoAuthentication family: Trust&GO, TrustFLEX, TrustCUSTOM. https://onlinedocs.microchip.com/oxy/GUID-5C346303-A9CB-4341-B67F-4354AB92FE04-en-US-3/GUID-67185155-9838-416B-8F46-33923D075394.html
  70. [267] Microsoft. (2026). Device Update for IoT Hub. https://learn.microsoft.com/en-us/azure/iot-hub-device-update/understand-device-update
  71. [268] Microsoft. (2026). What is Azure IoT Hub Device Provisioning Service? https://learn.microsoft.com/en-us/azure/iot-dps/about-iot-dps
  72. [269] Microsoft. (2026). What is Azure IoT Operations? https://learn.microsoft.com/en-us/azure/iot-operations/overview-iot-operations
  73. [276] National Institute of Standards and Technology. (2023). Cryptographic Module Validation Program, certificate 4421: Microchip Trust Anchor TA100. https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4421
  74. [277] National Institute of Standards and Technology. (2026). Cryptographic Module Validation Program, certificate 5371: Microchip Trust Anchor TA101. https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5371
  75. [278] National Institute of Standards and Technology. (2026). FIPS 140-3 Transition Effort. https://csrc.nist.gov/projects/fips-140-3-transition-effort
  76. [284] Nordic Semiconductor. (2024). nRF9151 Product Specification v1.0. https://mm.digikey.com/Volume0/opasdata/d220001/medias/docus/6470/NRF9151-DK.pdf
  77. [286] Nordic Semiconductor. (2025). Nordic Semiconductor acquires Memfault, launches the first complete chip-to-cloud platform. https://www.nordicsemi.com/Nordic-news/2025/06/Nordic-Semiconductor-acquires-Memfault
  78. [287] Nordic Semiconductor. (2026). nRF Cloud Location Services. https://docs.nrfcloud.com/docs/platform/location-services
  79. [288] Nordic Semiconductor. (2026). nRF9151. https://www.nordicsemi.com/Products/nRF9151
  80. [292] Northern.tech. (2026). Mender pricing. https://mender.io/pricing
  81. [295] NXP Semiconductors. (2024). Protecting the Edge at scale with NXP Security Solutions. https://www.nxp.com/docs/en/training-presentation/NXP-Security-Solutions-Protecting-the-Edge-at-scale-Technology-Six-Pack.pdf
  82. [296] NXP Semiconductors. (2026). EdgeLock 2GO service platform. https://www.nxp.com/products/security-and-authentication/authentication/edgelock-2go:EDGELOCK-2GO
  83. [297] NXP Semiconductors. (2026). EdgeLock SE050 Plug and Trust secure element family. https://www.nxp.com/products/SE050
  84. [298] NXP Semiconductors. (2026). EdgeLock SE051 Plug and Trust secure element. https://www.nxp.com/products/SE051
  85. [301] OASIS. (2019). MQTT Version 5.0. https://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html
  86. [302] OASIS. (2022). Common Security Advisory Framework Version 2.0. https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html
  87. [303] OASIS. (2026). Common Security Advisory Framework Version 2.1, Committee Specification Draft 03. https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html
  88. [308] ONEKEY GmbH. (2026). ONEKEY product cybersecurity and compliance platform. https://www.onekey.com/
  89. [312] OPC Foundation. (2025). OPC 10000-14: OPC UA Part 14 PubSub, v1.05.06. https://reference.opcfoundation.org/Core/Part14/v105/docs/7.3.4
  90. [321] OWASP Foundation. (2026). OWASP Dependency-Track. https://owasp.org/www-project-dependency-track/
  91. [325] PSA Certified. (2026). Getting certified: security levels. https://www.psacertified.org/getting-certified/
  92. [326] PSA Certified. (2026). PSA Certified products database. https://products.psacertified.org/
  93. [340] Saft. (2026). LS 17500 primary lithium-thionyl chloride A-size cell, data sheet. https://saft4u.saft.com/en/download_file/6fbdd60f-bba6-4f67-81a0-85ce1b412664/English
  94. [341] Saft. (2026). LS 33600 primary lithium-thionyl chloride D-size cell, data sheet. https://saft4u.saft.com/en/download_file/5241def1-8668-4a68-9d2e-820bd3c68589/English
  95. [355] Semtech. (2025). LoRa Cloud is sunsetting on July 31st 2025. https://www.semtech.com/loracloud-shutdown
  96. [368] STMicroelectronics. (2026). STSAFE-A110 authentication, state-of-the-art security for peripherals and IoT devices. https://www.st.com/en/secure-mcus/stsafe-a110.html
  97. [373] Swisscom. (2025). Abschaltung 3G. https://www.swisscom.ch/de/about/news/2025/12/16-abschaltung-3g.html
  98. [394] Trusted Computing Group. (2024). TPM 2.0 Library, Family 2.0, Level 00, Revision 01.83. https://trustedcomputinggroup.org/resource/tpm-library-specification/
  99. [395] Trusted Firmware. (2026). Trusted Firmware-M documentation. https://trustedfirmware-m.readthedocs.io/
  100. [397] u-blox. (2026). MAX-M10S data sheet UBX-20035208 R08. https://content.u-blox.com/sites/default/files/MAX-M10S_DataSheet_UBX-20035208.pdf
  101. [398] umati / VDMA. (2026). About umati. https://umati.org/about/
  102. [402] VDE. (2022). VDE-AR-E 2829-6-1:2022-12 Energy management in the smart home, use cases. https://vde-verlag.de/standards/0800840/vde-ar-e-2829-6-1-anwendungsregel-2022-12.html
  103. [403] VDE FNN. (2025). Neues erweitertes Lastenheft Steuerbox 1.5. https://www.vde.com/de/fnn/aktuelles/neues-erweitertes-lastenheft-steuerbox-1-5-
  104. [408] Vodafone Deutschland. (2020). Vodafone aktiviert bundesweit das Netz für Mensch und Maschine. https://unternehmen.vodafone.de/newsroom/vodafone-aktiviert-bundesweit-das-netz-fuer-mensch-und-maschine
  105. [411] Wi-Fi Alliance. (2026). WPA3 deployment options. https://www.wi-fi.org/system/files/WPA3_Deployment_Options_Highlights_202602.pdf
  106. [413] Wirtschaftskammer Österreich. (2026). Abschaltung 2G- und 3G-Netz in Österreich. https://www.wko.at/sicherheitsanlagentechnik/abschaltung-2g-und-3g-netz-in-oesterreich
Next

Contents

Report overview
  1. 1Deadlines and scope
  2. 2Device requirements
  3. 3Cost per device
  4. 4Technology and architecture
  5. 5Spotlight: logistics tracking
  6. 6Spotlight: Austria and Switzerland
  7. 7Vendor landscape
  8. 8Recommendations
  9. AMethod
  10. BLegal basis
  11. CCost model
  12. DVendor directory
  13. EFunding programmes
  14. About RUBINLAKE
  15. Disclaimer
  16. References