TÜV Rheinland: Cyber security requirements are growing rapidly

CRA, NIS-2, RED: Complex regulatory environment for companies

Take regulatory requirements, for example: The European Union’s Radio Equipment Directive (RED) will be expanded to include cybersecurity requirements on August 1, 2025. From then on, devices sold in the EU with built-in radio technology must comply with the RED cybersecurity requirements. In addition, there is the second EU Directive on network and information security (NIS-2) and the Cyber Resilience Act (CRA), which affect an ever-increasing number of companies and products. “Globally active companies must also harmonize different regulations. This is a particularly big challenge, as some countries, such as the US, tend to favor risk-based approaches, while the EU often has stricter security requirements and reporting obligations,” explains Felix Brombach, Practice Leader for OT Security at TÜV Rheinland.

Fundamental errors still widespread

Cyberattacks are also becoming increasingly complex. In 2024, for example, multiple extortions were widespread among cybercriminals: attackers no longer limit themselves to encrypting data but also threaten to release sensitive information if a ransom is not paid. “In view of the threats, companies should avoid some fundamental mistakes that we still see, such as inadequate backups, insufficient employee training, outdated systems, non-existent incident response plans, and paying ransom,” reports David Allen, team leader for cybersecurity at TÜV Rheinland.

More and more points of attack

In addition to complexity, companies’ IT departments are also concerned about the ever-increasing number of potential points of attack for cybercriminals. The growing connectivity of Internet of Things (IoT) devices, cloud services, decentralized networks, and the use of AI are increasing security risks. Sectors such as healthcare, finance, and education are particularly at risk, according to Massimiliano Latini, cybersecurity expert at TÜV Rheinland: “Organizations are forced to adapt their IT security strategies accordingly—for example, through proactive security measures and the automation of security processes.”

Further information can be found in the interviews published at www.tuv.com/cybersecurity-trends.