Interim CIO: Dr. Claus Michael Sattler
CDMO Purchasing
How can CDMOs make the most of the Cyber Resilience Act in the procurement process?
The pharmaceutical industry, especially Contract Development and Manufacturing Organizations (CDMOs), face a number of challenges and opportunities with regard to the Cyber Resilience Act (CRA). This new EU regulation offers CDMOs the opportunity to increase their competitiveness by making the most of the CRA in the CDMO purchasing process. The CRA requires manufacturers of products with digital elements to strengthen their cybersecurity and ensure that all requirements are met throughout the product lifecycle.
What is the Cyber Resilience Act?
The Cyber Resilience Act is an EU regulation that focuses on the cybersecurity of connected products. The CRA applies to hardware and software with digital components and requires manufacturers to actively minimize cybersecurity risks throughout the entire product life cycle. The aim is to create a uniform Europe-wide standard for the cybersecurity of products and to strengthen consumer confidence [source: 6].
CDMO purchasing and the Cyber Resilience Act
In the CDMO purchasing process, the CRA can be used as an argument for a secure and reliable supply chain. By complying with the CRA requirements, CDMOs can ensure that their suppliers also meet the required cybersecurity standards. This can serve as a control tool to minimize the risk of cyberattacks along the entire supply chain.
Strategies for using the CRA in CDMO purchasing
To make the best use of CRA in CDMO purchasing, CDMOs should pursue the following strategies:
- Risk assessment and management: A comprehensive risk assessment is crucial to identify and evaluate potential security risks in the supply chain. This includes analyzing cyberattacks on critical infrastructure and taking regulatory changes into account [source: 2].
- Implementation of cybersecurity requirements in the purchasing process: CDMOs should ensure that all suppliers meet the requirements of the CRA. This can be done by integrating cybersecurity criteria into purchasing contracts [source: 1].
- Collaboration with suppliers: Collaboration with suppliers is critical to ensure that all CRA requirements are met. This can be done through regular audits and safety checks [source: 4].
- Develop a vulnerability management process: Effective vulnerability management is critical to quickly responding to and remediating security vulnerabilities. This also includes the creation of a software bill of materials (SBOM) [source: 3].
- Promote collaboration across industry boundaries: Collaboration with other companies and industries can help to overcome existing challenges more effectively and share best practices.
Competitiveness through the CRA
Compliance with the requirements of the CRA can be a significant competitive advantage for CDMOs. By complying with the CRA, CDMOs can build trust with consumers and regulators, which increases their competitiveness in the marketplace. Compliance also provides the opportunity to optimize processes and reduce costs through more efficient safety measures.
Conclusion
The Cyber Resilience Act offers CDMOs the opportunity to increase their competitiveness by making the most of the CRA in the CDMO purchasing process. By integrating cybersecurity requirements into the purchasing process and working with suppliers, CDMOs can ensure that their supply chain is secure and reliable. Collaboration with other industries and consideration of guidelines such as NIS2 and DORA are key to developing a comprehensive CDMO procurement strategy.
The Cyber Resilience Act will play a central role in shaping the cybersecurity landscape in the EU in the coming years. Through its comprehensive requirements for manufacturers of products with digital elements, it will help keep consumers and businesses safer. The challenges posed by the CRA also offer opportunities for innovation and growth, especially in sectors such as the pharmaceutical industry, which are particularly affected by increasing digitalization. CDMO purchasing can become a crucial control tool through the CRA to ensure cybersecurity along the entire supply chain.
CDMO purchasing processes can be optimized through the CRA by CDMOs auditing their suppliers for compliance with CRA requirements. This can be used as an argument for a secure and reliable supply chain, which increases the competitiveness of CDMOs. Collaboration with other companies and consideration of guidelines such as NIS2 and DORA are key to developing a comprehensive CDMO purchasing strategy.
Sources
- https://www.european-cyber-resilience-act.com/Cyber_Resilience_Act_Article_5.html
- https://www.outsourcedpharma.com/doc/new-eu-directive-marks-cybersecurity-regulatory-paradigm-shift-for-bio-pharma-medical-devices-0001
- https://my.avnet.com/silica/solutions/security-services/secure-device-management-provisioning/cyber-resilience-act/
- https://supplychaindigital.com/technology/kroll-cybercriminals-target-supply-chain-it
- https://boracdmo.com/how-a-cdmo-can-increase-the-competitiveness-of-your-product/
- https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
- https://cybermagazine.com/articles/a-mixed-response-on-eus-new-vulnerability-disclosure-rules
- https://www.cyberresilienceact.eu/the-cyber-resilience-act/
- https://www.european-cyber-resilience-act.com
- https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act
- https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Cyber_Resilience_Act/cyber_resilience_act_node.html
- https://locaterisk.com/en/cybersicherheit-in-der-digitalen-lieferkette/
- https://www.marketsandmarkets.com
- https://www.european-cyber-resilience-act.com/Cyber_Resilience_Act_Preamble_11_to_20.html
- https://markets.ft.com/data/announce/detail?dockey=600-202503110800PR_NEWS_USPRX____LA37635-1
- https://www.cyberresilienceact.eu/the-cra-explained/
- https://ec.europa.eu/commission/presscorner/detail/en/QANDA_22_5375
- https://www.rmmagazine.com/articles/article/2024/08/08/challenges-and-opportunities-of-the-eu-cyber-resilience-act
- https://www.rolandberger.com/en/Insights/Publications/Unlocking-Value-in-the-CDMOs-market.html
- https://www.europeanlawblog.eu/pub/cybersecurity-for-europe-without-a-legal-basis
- https://www.simon-kucher.com/en/insights/unlocking-better-growth-cdmos
- https://www.womblebonddickinson.com/uk/insights/articles-and-briefings/eu-cyber-resilience-act
- https://www.ey.com/en_gl/insights/strategy/how-cdmo-companies-are-leading-innovation-for-pharmaceutical-partners
- https://www.strategyand.pwc.com/de/en/industries/pharma-life-sciences/2022-global-cdmo-study.html
- https://www.concepture.de/en/eu-cyber-resilience-act-requirements-impacts-for-businesses/
- https://www.prnewswire.com/news-releases/optimizing-outsourcing-a-case-study-on-evaluating-cdmo-capabilities-for-api-and-fd-development-302341149.html
- https://www.enisa.europa.eu/publications/cyber-resilience-act-requirements-standards-mapping
- https://www.reuschlaw.de/en/news/the-cyber-resilience-act-content-and-practical-implementation/
- https://drug-dev.com/cdmo-case-study-ajility-streamlining-drug-product-manufacturing/
- https://www.pwc.de/de/cyber-security/case-study-sichere-produktentwicklung-und-cra-compliance.html
- https://www.unity-consulting.com/en/consulting-services/governance-risk-compliance/cyber-resilience-act/
- https://www.pwc.de/de/gesundheitswesen-und-pharma/studie-pharma-cdmo-market.pdf
- https://www.european-cyber-resilience-act.com/Cyber_Resilience_Act_Articles.html
- https://www.outsourcedpharma.com/doc/one-stop-shop-or-best-of-breed-cdmo-selection-case-studies-0001
- https://www.zuehlke.com/en/insights/cyber-resilience-act-how-the-eu-security-regulation-affects-business
- https://industrialcyber.co/regulation-standards-and-compliance/eu-cyber-resilience-act-takes-effect-brings-new-era-of-mandatory-cybersecurity-standards-for-digital-products/
- https://www.taylorwessing.com/-/media/taylor-wessing/files/germany/2025/tw24_cra_2.pdf
- https://www.dotmagazine.online/issues/building-trust-in-the-digital-world/the-cyber-resilience-act-iot-security
- https://industrialcyber.co/regulation-standards-and-compliance/eu-adopts-cyber-resilience-act-bolsters-security-requirements-of-connected-devices-and-infrastructure/
- https://www.ocmconsulting.de/en/references-highlights/case-studies/procurement-pharmaceutical-raw-materials
- https://cdn.digitaleurope.org/uploads/2024/09/Developing-guidelines-for-the-Cyber-Resilience-Act_DE.pdf
- https://www.strategyand.pwc.com/de/en/industries/pharma-life-sciences/2022-global-cdmo-study/strategyand-2022-global-cdmo-study.pdf
- https://www.pickplace.de/en/hub-blog-1/der-cyber-resilience-act-und-die-bedeutung-f%C3%BCr-eingebettete-elektronik
- https://apeloconsulting.com/case-studies/cdmo-case-study/
- https://www.linkedin.com/posts/stephencawley_impact-of-eu-cyber-resilience-act-on-device-making-activity-7190979261615276032-rsZS
- https://ubuntu.com/blog/a-cisos-comprehensive-breakdown-of-the-cyber-resilience-act
Dr. Claus Michael Sattler
