Close-up of digital threads forming a protective shield on the topic of cybersecurity
Cybersecurity Testing and Certification at the VDE Institute
Request a Quote
Current Events
Read more
Contact
VDE Testing and Certification Institute
VDE Institute News
Read more
Looking for Studies, Position Papers or Standards?


> VDE Verlag

In the Shop of the VDE Publishing House you will find electrotechnical safety standards and books.


More knowledge, more success!

Many publications, VDE Studies, magazine subscriptions and books are price reduced for VDE members. Become a VDE member now!

Cybersecurity Testing and Certification at the VDE Institute

The VDE provides manufacturers of connected electrical products with in-depth expertise to help them meet complex cybersecurity requirements. We offer support through in-depth technical analysis, standards-compliant testing procedures, structured risk analyses, and comprehensive consulting—ranging from security architecture and vulnerability assessments to complete documentation for market access.


What obligations apply to manufacturers and importers?

Icon Alert
VDE

Connected electronic products are subject to strict legal requirements that manufacturers must comply with. The Radio Equipment Directive (RED), which took effect in August 2025, requires that certain devices with radio and internet connectivity meet information security requirements, and this is also included in the CE declaration. The subsequent EU Cyber Resilience Act (CRA) mandates comprehensive security measures such as risk analyses, vulnerability management, and regular updates, and makes comprehensive cybersecurity a prerequisite for the CE marking of products that communicate electronically. Relevant standards such as IEC/EN 62443, EN 18031 (for the RED 3.3 d, e, f requirements), and EN 303 645 support the implementation of technical security standards. Additionally, manufacturers are liable for security deficiencies, and market surveillance authorities can remove products from the market if their cybersecurity is inadequate.


VDE Testing Services for Safe, Connected Products

Cybersecurity is not only a mark of quality, but also a legal requirement and a key competitive factor. VDE helps you meet the growing demands for IT security reliably, efficiently, and in compliance with standards.

Request a Quote


Information About the VDE Testing and Certification Process

The testing and certification process for electrical products follows a structured, standards-based approach from the initial inquiry to successful certification. VDE supports manufacturers through every project phase, including during product development, ensuring regulatory requirements are incorporated early into design, layout, and component selection.

We receive your request for a quote, including a product description, target markets, technical specifications, desired certification marks, etc., through our sales department or the relevant technical department. 

We will prepare a customized quotation for you, including a list of standards, a test plan, a timeline, and a cost estimate.
Timeframe: Weeks 0–2

We perform all necessary tests on your product in accordance with your specific order. 
Timeframe: Weeks 2-6

During this phase, we begin preparing the first test reports and document any nonconformities with standards, if applicable. Should any arise, you will receive recommendations for improvement. If you wish to make corrections or changes to your product, additional partial tests will be required, which may extend the duration of the entire project.

Our independent certification body evaluates and verifies all test results (completeness check, confirmation of compliance with standards). A certification decision is then made (approval / conditions / rejection).
Timeframe: Weeks 6-7

Upon successful certification, we will issue your certificate, and you will receive the test report and, if applicable, a mark usage agreement. Manufacturers may now affix the certification mark to the product and market it.
Timeframe: Weeks 7-8

How does the VDE help organizations meet cybersecurity requirements?

We help you view cybersecurity not as an obstacle, but as an opportunity. In addition to implementing uniform audit standards, we also offer security audits and certification in the areas of data protection, cybersecurity, and functional safety. 

With our testing services, you can ensure that your products:

  • meet legal requirements
  • are protected against cyberattacks
  • build trust with your customers
  • remain competitive in the market over the long term

Our information security audits are based on the following regulations and standards:

  1. VDE-PB-0004 und -0005
  2. IEC 62443-4-1 und -4-2
  3. ETSI EN 303 645
  4. VDE-PB-0033
  5. EN 18031-1 / 18031-2 / 18031-3

Penetration Testing for Devices, Apps, and Cloud Services

VDE conducts penetration tests in a structured manner and in compliance with standards, documents all vulnerabilities found, and provides specific technical recommendations for securing the systems. The tests are divided into three areas: testing of devices (communication devices and gateways), testing of backend and cloud systems, and testing of apps for smartphones and tablets. In this process, the cybersecurity objectives are tested in the product and system design as well as in the implementation. Documentation for the user and the technical aspects of data protection are integral parts of the test.

Request a Quote

Meet our experts at electronica 2026

Unscharfer Messehintergrund mit Ausstellern und Besuchern, Messestand und Besuchern
DNY3D / stock.adobe.com; KI-generiert

November 10, 2026 - November 13, 2026 | Munich
Hall A4, booth 23
8

As the world’s leading trade fair, every two years electronica provides a comprehensive update of the rapidly developing technology in all fields of electronics. Here, leading companies present forward-looking innovations and use the trade fair to expand and maintain their global networks.

You are welcome to schedule a meeting with our VDE experts at the trade show.

Appointment scheduling

Ready for CRA? Get your first CRA assessment in just a few steps

Zahlencode, digitaler Code, Schloss, Programmierung und Sicherheit
peshkov / stock.adobe.com
2026-08-27

To help you, as a manufacturer or importer, determine whether you are already prepared for the CRA, we are providing a checklist here that clearly shows you which requirements have not yet been addressed.

Check it out now

In the field of information security, we offer the following VDE certificates, among others:


Upgrade for your knowledge: our free online seminars

Online Seminar
putilov_denis / stock.adobe.com

Through our free online seminars, we keep you informed about the latest developments in the testing and certification of electrical equipment and systems. Our experts discuss the latest trends as well as the perennial topics in the world of certification. In doing so, they draw on a wealth of experience gained over 100 years of testing and certification.

Register now

Is it all too complex and unclear?

Icon as question-answer speech bubble
VDE

We support both experienced engineering departments and manufacturers who are facing regulatory requirements for the first time.

Even if you have no prior knowledge, the VDE provides clarity on responsibilities, required tests, documentation requirements, and realistic timelines.

FAQs on Cybersecurity and IT Security

As a manufacturer, what legal requirements must I absolutely comply with?

Devices with a wireless module and an Internet connection must comply with the requirements of RED 3.3. d, e, f (Radio Equipment Directive). Starting this year, requirements under the CRA (Cyber Resilience Act) will be added: as of September 11, 2026, obligations to report incidents and vulnerabilities; and as of December 11, 2027, requirements for products with digital components.

What happens if my product does not meet the cybersecurity requirements?

In that case, a product cannot be placed on the market and/or distributed in Europe. Market surveillance authorities could remove products from the market (RED+CRA) and impose penalties (CRA).

Do I need to conduct a risk analysis for my product, even if it's very simple?

Yes, the CRA requires, among other things, a risk analysis for all products covered by the regulation as part of the technical documentation.

How can I ensure that my device's communications are adequately protected?

With appropriate planning, a secure design, and implementation focused on cybersecurity. Additionally, with technical assessments (e.g., penetration tests) and the corresponding technical documentation.

What does “Security by Design” mean, and how can I put it into practice?

Integrating cybersecurity as early as the planning and design phases, implementing a multi-layered security approach (security in depth), and taking into account potential threats and user errors.

Which standards apply to my product, and how can I find out?

The standards EN 18031-1, -2, and -3 are listed for RED 3.3 d, e, f (with restrictions). For the CRA, two standardization bodies are currently developing corresponding standards.

Can I conduct the cybersecurity audits myself, or do I need an audit firm?

In general, tests should also be conducted in-house (during development). However, a conformity assessment against a specific standard or regulation should be conducted by an independent body in order to demonstrate the highest possible level of protection.


Additional Testing and Service Offerings from the VDE