Industrial Cybersecurity for Connected Safety Systems

IT security focuses on protecting data confidentiality, integrity and availability in business systems such as email, ERP and databases. OT security protects operational technology: the industrial control systems, sensors and safety devices that run physical processes. OT environments have different priorities. Availability and safety often outweigh confidentiality. Downtime can mean physical danger, not just business disruption. At Dräger, we address both domains, recognising that connected safety systems bridge IT and OT and require protection across both.

Security-by-design means building protection into products from the earliest architectural decisions, not adding it later. Our IN6000 development process mandates threat modelling, secure coding practices and privacy-by-design principles. Every product release undergoes security review before market introduction. This approach reduces vulnerabilities at the source and lowers the cost of remediation throughout the product lifecycle.

A SBOM is a comprehensive inventory of all software components in a product including open-source libraries, third-party modules and proprietary code. It enables organisations to quickly assess their exposure when new vulnerabilities are disclosed. The Cyber Resilience Act will require manufacturers in the EU to maintain and provide SBOMs, while similar expectations are emerging in the UK through legislation such as the PSTI Act. We are continuously expanding SBOM availability across our portfolio as part of an ongoing improvement program in order to support your vulnerability management and compliance processes.

Dräger operates a Product Security Incident Response Team (P-SIRT) that coordinates vulnerability handling. When vulnerabilities are identified - internally or through external researchers, we assess the risk, develop fixes and communicate with affected customers. We follow coordinated disclosure practices and publish security advisories where appropriate. Customers can report potential vulnerabilities through psirt@draeger.com.

The CRA entered into force in December 2024. Reporting obligations for actively exploited vulnerabilities begin on 11 September 2026. Full compliance including conformity assessments, technical documentation and SBOM provision is required by 11 December 2027. Manufacturers, importers and distributors of products with digital elements all have obligations. Non-compliance can result in fines up to €15 million or 2.5% of global turnover.

In the EU, NIS2 requires organisations to implement risk management measures covering incident handling, business continuity, supply chain security, network security and vulnerability disclosure. In the UK, similar obligations apply under the NIS Regulations, supported by guidance from the National Cyber Security Centre (NCSC). Significant incidents must be reported to authorities within 24 hours (early warning) and 72 hours (full notification). Management bodies can be held personally liable for compliance failures. Penalties can reach €10 million or 2% of global turnover for essential entities. The directive applies across sectors including energy, transport, health, manufacturing and digital infrastructure.

Start with asset inventory: document all connected devices, software versions and data flows. Map your controls against relevant standards (ISO 27001, IEC 62443, NIS2 requirements). Ensure you can demonstrate evidence like policies, procedures, training records, incident logs and test results. Dräger provides documentation and compliance support to help customers demonstrate the security posture of our solutions within their broader audit scope.

BitSight is an independent, data driven rating system that evaluates an organisation’s externally observable cybersecurity performance. It continuously monitors factors such as compromised systems, vulnerability exposure, diligence behaviours and the likelihood of ransomware or security incidents.

Dräger maintains an Advanced BitSight rating of 790, significantly above the industry average of 730 in the medical and safety technology sector. This places us in the top performance tier and aligns our risk level with companies rated 750+, which are associated with lower ransomware and security incident exposure.

For customers, this provides transparent, third-party validation that our industrial cybersecurity practices across infrastructure, cloud environments and connected safety products meet a high and continuously monitored security standard. We use BitSight insights proactively to strengthen our resilience, reduce cyber risk for our ecosystem and support safe, reliable operations in industrial environments.