Hosted IoT Device Management for Cyber Resilience Act Compliance

PHYTEC is releasing phyHUB, a modular device management and cybersecurity monitoring platform that integrates L-IoT cloud architecture from ML!PA. This hosted service enables industrial automation and embedded systems manufacturers to maintain automated software lifecycles and secure over-the-air update capabilities across their deployed device fleets.

Regulatory Requirements for Embedded Systems
Since September 11, 2026, the European Union Cyber Resilience Act (CRA) mandates that manufacturers of digital products report actively exploited vulnerabilities and severe security incidents within 24 hours. To meet these compliance thresholds, original equipment manufacturers must continuously map newly disclosed Common Vulnerabilities and Exposures (CVEs) against the Software Bill of Materials (SBOM) of deployed devices. The integrated platform addresses this regulatory requirement by automating CVE monitoring and executing cryptographically signed over-the-air (OTA) updates. These updates utilize staging and rollback mechanisms to ensure system stability while providing the traceable documentation required for compliance audits.

Hosted Architecture and Lifecycle Management
The partnership transitions the L-IoT software from a traditional customer-hosted model to a multi-tenant device management-as-a-service infrastructure operated by PHYTEC. Hosted on Microsoft Azure in the West Europe region to ensure data sovereignty and tenant separation, the system allows manufacturers to bypass local server administration. It is engineered to function with both proprietary and third-party hardware, managing cryptographic key generation, secure boot provisioning, and continuous board support package (BSP) updates. Bodo Huber, Managing Director and CTO at PHYTEC, notes that the integration provides a necessary compliance mechanism, as manufacturers face market access restrictions if they cannot securely update deployed products.

Fleet Deployment and System Interoperability
Targeting industrial applications where long-term maintainability is critical, the underlying L-IoT architecture is utilized by heavy equipment and transit manufacturers such as Liebherr and Knorr-Bremse. The system prevents vendor lock-in by allowing clients to migrate the hosted L-IoT instance directly onto their own physical or cloud infrastructure if their operational requirements change. Tobias Maier, Managing Director of ML!PA Consulting, indicates that this dual-deployment capability accommodates manufacturers requiring either a fully managed service provider or direct control over their device management networks.

Additional Context
This section details technical specifications and competitive benchmarking not included in the original news release.

In the industrial IoT device management sector, OTA update and CVE monitoring platforms are benchmarked on deployment scalability, atomic update reliability, and cloud infrastructure compatibility. The phyHUB system competes with dedicated embedded fleet management platforms such as Mender.io and Balena. Mender provides an open-source OTA update manager that utilizes dual A/B partition updates to ensure atomic installations, which automatically roll back to the previous system state if a boot sequence fails. Balena utilizes a container-based architecture built on Docker, allowing discrete microservices deployment at the edge. By hosting L-IoT directly as a multi-tenant service and integrating it with physical hardware BSPs and secure boot provisioning, the PHYTEC platform functions as an end-to-end managed service, eliminating the need for original equipment manufacturers to build and maintain the cloud backend required by purely self-hosted, open-source alternatives.

Edited by Lekshman Ramdas, Induportals editor – adapted by AI.

www.phytec.com