IoT network hardening and compliance with the RED directive

Informatec Digital » Resources » IoT network hardening and compliance with the RED directive

The explosion of IoT and radio devices in homes, factories, energy, healthcare, and transportation has completely changed the way we connect… and also the attack surface available to cybercriminals. Every smart meter, every wearable, and every industrial sensor is, in practice, a potential entry point into the network if it hasn't been designed with security in mind from the outset.

In this context, hardening IoT networks under the Radio Equipment Directive (RED) and the upcoming Cyber ​​Resilience Act (CRA) has become a critical issue for manufacturers, integrators, operators, and any company selling connected products in the European Union. It's not just about "complying with paperwork": the new legal obligations impose very specific cybersecurity, privacy, and fraud protection requirements that impact the design of hardware, firmware, software, connectivity, and cloud services.

European legal framework: why RED and CRA change everything

Over the past decade, the IoT has expanded thanks to technologies like Wi-Fi, Bluetooth, and NFC, which have transformed countless products into radio devices capable of communicating with each other and with the cloud. However, in cybersecurity, these devices are considered one of the weakest points: many smart home solutions still lack even minimal protection, and in industrial and manufacturing environments, there are still enormous gaps in both IT and OT security.

The economic impact of this situation is brutal: the global cost of cybercrime was around 5,5 trillion euros in 2020 according to the EU Council, and recent studies such as the one by Trend Micro indicate that nearly 90% of German energy, oil and gas or manufacturing companies suffered cyberattacks in just 12 months, with average damages of almost 3 million euros per company.

Meanwhile, the rise of wearables and data-driven, AI-powered business models has further highlighted the importance of protecting personal information. Regulations such as the GDPR (Regulation (EU) 2016/679) or the former R&TTE Directive 1999/5/EC have fallen short in covering the types of threats currently facing connected devices, especially regarding advanced cyberattacks, online fraud, and service manipulation.

In response, the European Union has strengthened the Radio Equipment Directive (RED) 2014/53/EU , in force since 2016, which replaced the R&TTE. RED already regulated electromagnetic compatibility, electrical safety, and the efficient use of the radio spectrum; now, it also incorporates high-level cybersecurity obligations that affect most connected radio equipment, including many IoT devices.

Delegated Regulation (EU) 2022/30 and Articles 3(3)(d)-(f) RED

The real turning point came with Delegated Regulation (EU) 2022/30 , adopted on 29 October 2021. This regulation “activates” Articles 3(3)(d), (e) and (f) of the NET, defining which categories of radio equipment must comply with the new requirements for cybersecurity, privacy and protection against fraud.

The standard focuses on several particularly sensitive product families, including a large part of the consumer and professional IoT ecosystem :

• Internet-connected radio equipmentAny device that can communicate with the network, directly or indirectly. This includes smartphones, tablets, routers, home IoT devices, connected industrial sensors, etc.
• Radio equipment for childcare: products designed exclusively to monitor or assist in the care of minors, such as connected baby monitors.
• Radio equipment covered by the Toy Safety Directive 2009/48/ECToys with radio functions capable of recording, storing or sharing information, interacting with users (especially children) or that integrate microphones, speakers or sensors.
• Wearable radio devices: everything designed to be worn on or over clothing, such as smartwatches, activity trackers, headsets, headphones or smart glasses.

It is important to note that certain categories are excluded from this regulation because they already have their own specific framework: medical devices (Regulations (EU) 2017/745 and 2017/746), civil aviation equipment, electronic toll systems and other devices regulated by different sectoral legislation and excluded from the scope of RED.

Initially, these new obligations were to apply from August 1, 2024, but the European Commission decided to postpone the date by one year to give the industry time. The new mandatory deadline for compliance with Delegated Regulation (EU) 2022/30 is August 1, 2025. Manufacturers, distributors, and OEMs that integrate radio modules should use this time to adjust designs, secure development processes, and conformity documentation.

Cybersecurity, privacy and anti-fraud requirements in the network

Articles 3(3)(d), (e) and (f) of the RED contain the core of the new security requirements, designed to reduce the risks associated with the connectivity of radio equipment, especially IoT devices.

Article 3(3)(d) addresses all internet-connected radio equipment and requires that it be designed so as not to harm the network or its functions, abuse network resources, or unacceptably degrade service . In practice, this entails measures to prevent a compromised device from taking down a service, launching a DDoS attack, or interfering with the availability of critical networks.

Article 3(3)(e) focuses on the protection of personal data and the privacy of users and subscribers. It requires that radio equipment processing personal data incorporate safeguards to prevent unauthorized access or improper transmission of information, for example through robust access controls, encryption of data in transit and at rest, and privacy-by-design and data minimization principles.

Article 3(3)(f) introduces specific requirements for devices that process virtual currency or monetary values , that is, those involved in digital payments, electronic wallets, or similar operations. These devices must include enhanced fraud controls, such as strong user authentication mechanisms, transaction integrity checks, and suspicious activity detection.

Furthermore, Article 4 of the RED addresses a key point for the IoT ecosystem : the combination of radio equipment with software. Manufacturers are required to provide information on the conformity of the intended hardware and software combinations, ensuring that, after a software update or modification, the product continues to meet the essential requirements of the directive.

Scope of application: what is considered radio equipment

To understand exactly what is included in these obligations, we must return to the directive's own definition. According to Article 2(1) of the RED , radio equipment is defined as any electrical or electronic product that transmits and/or receives radio waves for the purposes of radiocommunication or radionavigation, or that requires accessories (such as an antenna) to do so.

This definition is qualified by the exclusions in Article 1(2), 1(3) and Annex I , which exclude certain specifically regulated equipment. Furthermore, Delegated Regulation 2022/30 adds the condition that the device must be able to connect to the internet for the cybersecurity requirements of Articles 3(3)(d)-(f) to apply.

In practice, most products with IoT capabilities and wireless connectivity marketed in the EU will come under the RED's radar: from a connected thermostat to an industrial controller with a cellular module, including wearables, home routers, smart speakers or smart building solutions.

Harmonized standards EN 18031: the technical roadmap

To make it easier for manufacturers to demonstrate compliance, the European Commission tasked CEN and CENELEC with developing technical standards that translate legal requirements into concrete controls and tests. This work resulted in the harmonized standards of the EN 18031 series.

Since January 28, 2025, three EN 18031 standards have been harmonized under the RED , providing a relatively clear path for cybersecurity assessment:

• EN 18031-1: defines basic cybersecurity requirements for radio equipment, including authentication, encryption, credential management, secure boot mechanisms, and firmware update processes.
• EN 18031-2It focuses on privacy safeguards for teams that handle personal or location data, with measures for data minimization, user control, and protection against leaks.
• EN 18031-3It addresses the security of devices involved in digital payments and virtual money, reinforcing transaction integrity and protection against fraud.

Even so, simply “ticking the box” to comply with the standard is not enough . Some clauses in these standards have restrictions and do not cover all scenarios. For example, products that allow operation without a mandatory password, lack adequate parental controls, or offer optional security settings may require additional measures or a more thorough evaluation.

In such cases, the recommendation is to involve a Notified Body . These bodies, designated by the Member States, are responsible for carrying out conformity assessments when an independent third party is required. The Commission maintains an official list of Notified Bodies, and collaborating with one of them helps ensure that the product meets all the specific requirements, even when the direct application of harmonised standards is insufficient.

RED and Cyber ​​Resilience Act: overlaps and timeline

The Cyber ​​Resilience Act (CRA) adds another regulatory layer to the European cybersecurity ecosystem. Its scope is even broader than that of the RED Act, as it applies to virtually all “products with digital elements”: chips, software, devices, applications, etc., covering the entire lifecycle, from design to updates and vulnerability management.

The CRA establishes basic requirements such as the obligation to provide security updates for several years (drafts mentioned five years as a reference), as well as specific obligations for vulnerability management, responsible disclosure, user information, and incident reporting. Products are grouped into categories with different compliance schemes: self-assessment for non-critical products, third-party assessment or application of standards for Critical Class I, and assessment by a national body for Critical Class II.

To date, the CRA has already reached political agreement within European institutions , although its main requirements will not be applied until approximately three years after its entry into force. However, the obligations to report vulnerabilities and cyber incidents could come into effect before the end of 2025, which will force many companies to strengthen their incident response processes.

There is a clear overlap between RED and CRA: most radio equipment are also products with digital components . Furthermore, CRA incorporates the same cybersecurity objectives as Articles 3(3)(d)-(f) RED. However, the key point is the timeline: the obligations under RED and its Delegated Regulation will come into effect on August 1, 2025, while the bulk of CRA will come into force somewhat later.

In practice, this means that a manufacturer of connected thermostats launching a product in September 2025 will have to self-assess against at least the RED requirements (or rely on a Notified Body). Later, when the CRA is fully applicable, they may have to carry out a second assessment under that framework, although some convergence is expected: the RED requirements may eventually become a subset of the CRA requirements, facilitating the reuse of evidence and documentation.

Technical hardening of IoT networks and devices

Beyond regulatory compliance, hardening an IoT network requires a comprehensive systems approach . Securing only the device or just the cloud is insufficient: hardware, firmware, connectivity, APIs, backend, and operations must all be considered.

Key technical defenses include practices already aligned with the requirements of EN 18031, ETSI EN 303 645 or NIST 8259:

• Secure boot and firmware validation: prevent the execution of unauthorized code at device startup, verifying cryptographic signatures and ensuring firmware integrity.
• Hardening of interfacesDisable unnecessary ports and services, segment networks, and protect management interfaces with strong authentication and, where possible, restricted access.
• Communications encryption: employ modern protocols such as TLS 1.2+ or 1.3 for all data traffic, including telemetry, control commands and management channels.
• Robust credential management: remove default credentials, force the change on first use, enforce strong password policies and incorporate, where appropriate, multi-factor authentication mechanisms.
• Automatic and secure updates: establish OTA (Over-the-Air) update processes with cryptographic verification, encrypted channels and rollback capability in case of failure.
• API Security: authenticate and authorize all third-party calls, limit permissions using least privilege principles, and audit access to key resources.
• Behavioral monitoring and analytics: Apply anomaly detection solutions, often powered by AI, to identify unusual device behaviors, traffic overflows, or typical malware patterns.
• Supply chain security: verify the origin of hardware and software components, perform firmware analysis and demand security guarantees from suppliers.

In parallel, privacy must be natively integrated . This involves not only encrypting data, but also minimizing the information collected, offering clear user settings, avoiding unnecessary tracking, and aligning data processing with GDPR principles, by design and by default.

Practical compliance with RED: key processes and agents

For manufacturers, complying with RED and Delegated Regulation 2022/30 is not just an engineering issue , but also one of processes and governance. It is advisable to have a clear map of all affected products, their architecture, the data they handle, and the payment or monetization functions that may trigger the requirements of Article 3(3)(f).

In many cases, self-assessment can be performed , provided the product has been designed in accordance with harmonized standards and robust technical documentation is maintained. However, for complex scenarios or when the standard does not fully cover the use case, using a Notified Body provides legal and technical certainty.

While the industry awaits the maturation of harmonized standards and CRA assessment schemes, initiatives such as PSA Certified have emerged , offering certification frameworks aligned with emerging regulations (RED, CRA, and the UK's PSTI). PSA Certified Level 1, for example, includes a dedicated regulatory section where manufacturers can document their compliance with regulatory requirements and submit that documentation for independent review.

These types of schemes, aligned with global best practices such as EN 303 645 and NIST 8259 , allow OEMs, software providers and chip manufacturers to get ahead of the future, integrating from now on the controls required by both RED and CRA and other national frameworks.

IoT platforms, updates, and fleet management

Another key aspect of hardening IoT networks is the ability to centrally manage large fleets of devices . Without a robust management platform, applying patches, rotating certificates, or detecting suspicious behavior becomes nearly impossible at scale.

In this area, comprehensive IoT solutions that combine data orchestration, device management, over-the-air (OTA) updates, and AI capabilities for decision-making are becoming increasingly important. Features such as mutual SSL authentication, periodic certificate rotation, and secure firmware updates strengthen both the endpoint and the network.

Some platforms also integrate IoT-specific cybersecurity tools, including runtime security and continuous vulnerability analysis . This makes it easier to detect behavioral deviations in deployed devices, discover vulnerabilities both before and after production deployment, and prioritize mitigation actions.

In parallel, these platforms serve as the foundation for servitization-based business models : data monetization, subscription models, advanced AI/ML-based services, etc. Thus, the effort invested in RED compliance and enhanced security not only reduces risk but also opens the door to new revenue streams and value-added offerings.

This entire approach, when designed thoughtfully, demonstrates a clear commitment to safety and regulation on the part of manufacturers and technology providers, something increasingly valued by end customers and regulators alike.

Testing, certification, and conformity assessment service companies also play a significant role, offering technical audits, laboratory testing, and even specialized training on RED, CRA, and other regulations. Leveraging their expertise can greatly accelerate the learning curve for organizations facing this regulatory framework for the first time.

In short, the hardening of IoT networks within the framework of the RED and the future CRA requires a rethinking of the design of connected products, strengthening secure development, monitoring, and update processes, and thoroughly understanding how each device fits into the labyrinth of European regulations. Those who take on this challenge sooner will be better positioned to reduce risks, avoid penalties, and, at the same time, seize the opportunity to differentiate themselves through security, trust, and quality in an increasingly demanding IoT market.