Industrial gateway cybersecurity
See how Robustel builds security into its products, tests its operating systems and cloud platform, and responds when issues are reported. Review the supporting evidence for your supplier assessment.
- IEC 62443-4-1
- ISO/IEC 27001
- Annual penetration testing
- EN 18031
- CRA readiness
- Assess & designIdentify risks and threats
- Build & documentRecord components in an SBOM
- Verify & validateIndependent security testing
- Release & deployVersion-specific release guidance
- Monitor & assessCVE triage & PSIRT impact reviewArticle 14 reporting when required.
- Respond & improveFix, retest & release supported updates
Security evidence for your supplier review
IEC 62443-4-1
Certified development process · ML2Robustel’s product development lifecycle is certified to IEC 62443-4-1:2018 at Maturity Level 2. Robustel also uses IEC 62443-4-2 SL2 as an engineering benchmark. Product-level certification requires evidence for the specific device.
View the development certificateISO/IEC 27001
Certified information security managementSGS certified Robustel’s information security management system to ISO/IEC 27001:2022. The scope includes wireless IoT communications equipment design and manufacture, plus development, operation and maintenance of the device management cloud platform.
View the ISO/IEC 27001 certificateAnnual penetration testing
Independent, dated assessmentsRobustel’s annual testing programme covers device firmware, operating systems and cloud platforms. The 2026 independent assessments covered RobustOS on a router, RobustOS Pro on an edge gateway and the production and beta RCMS Cloud web applications.
- RobustOS Pro
- 13 April 2026
- RobustOS · RCMS Cloud
- 15 July 2026
Detailed reports available under NDA.
Read the assessment summariesEN 18031
RED evidence for 49 core router SKUsRobustel has obtained RED cybersecurity certification across 49 core router SKUs. The published scope covers EN 18031-1 and EN 18031-2. SGS certified the R1520-4L Global. Use the order code and firmware to identify the applicable evidence.
Check the covered router portfolioSecurity capabilities and supporting evidence depend on the exact model, hardware revision and firmware.
Cyber Resilience Act: what buyers can check
Robustel’s CRA readiness programme covers secure development and vulnerability handling. Its Product Security Incident Response Team (PSIRT) and Article 14 reporting process are operational. Future milestones are programme targets; timing and scope depend on the product family.
Read the CRA roadmapCRA dates and planned milestones
- Regulatory date
Article 14 reporting operational
Operational since September 2026 for qualifying actively exploited vulnerabilities and severe security incidents.
- Programme targetFebruary–June 2027
Security-feature previews
Target: first previews in February–March, then wider previews for selected existing software branches in June.
- Programme targetSeptember–November 2027
Assess, document & deliver
Target: assessments in September, documentation in October and planned EU deliveries from November for the relevant product scope.
- Regulatory date
Main CRA requirements apply
Main CRA requirements apply. Confirm the roadmap and current evidence for your product family and configuration.
What happens if a security issue is found?
PSIRT assesses reported vulnerabilities, including CVEs, to identify affected products and versions and evaluate the impact. If your product is affected, Robustel shares the known risk and verified protective steps while the investigation continues, then updates its guidance as further measures become available.
Article 14 reporting is triggered by qualifying actively exploited vulnerabilities or severe security incidents. For these events, Robustel notifies authorities in parallel with guidance for affected users: an early warning within 24 hours and a notification within 72 hours, both measured from awareness of the event.
Read the Article 14 reporting and user protection statementVulnerability assessment & remediation
Robustel prioritises reported vulnerabilities by severity, considering the potential impact, how readily the issue could be exploited and which deployments are exposed.
| Severity | Assessment target | Remediation target |
|---|---|---|
| Critical | Within 3 days | Within 14 days |
| High | Within 5 days | Within 30 days |
| Medium | Set at intake | Within 90 days |
| Low | Set at intake | Within 90 days |
These are targets for handling vulnerabilities. The Article 14 deadlines above apply to notifications to authorities.
Report a security concern
Send your concern directly to the security team. Include the product, firmware version and what you observed. The team will assess the severity and whether the event meets CRA reporting requirements.