The Charter-of-Trust (CoT) partners have agreed to deliver next-generation products with preset cybersecurity, following a clear “Security by Default” philosophy.

At present, there are no uniform regulations governing this issue – many products leave the factory solely dependent on safety systems that do not provide comprehensive protection. Users often have to adjust security settings afterward. As a first step, the Charter partner companies have now defined which security features should be present and activated by default in next-generation products – ranging from strong authentication features to a unique product identity and the requirement that passwords must be changed upon first use.

The CoT partners also believe that no undocumented functionalities or possibilities for remote connection should be part of initial device setup – another aspect that is not yet a general rule today. All these requirements are now being rolled out step by step within the relevant portfolios of the Charter of Trust member companies.

“Cybersecurity is a key ingredient for trust of our customers in all our businesses offering digitally connected products. It is also the basis for sustainable success and the foundation of a strong ecosystem “, says Roland Busch, deputy CEO, CTO, CHRO and Managing Board Member of Siemens AG.

At the Munich Security Conference in February 2018, Siemens and eight partners from the industrial sector launched a joint charter for more cybersecurity for the first time. Two years after signing, the Charter of Trust has grown to 17 members. In addition to Siemens and the Munich Security Conference, the companies AES, Airbus, Allianz, Atos, Cisco, Dell Technologies, Deutsche Telekom, IBM, Mitsubishi Heavy Industries, NXP Semiconductors, SGS, Total and TÜV SÜD have committed themselves to the document. Furthermore, the Federal Office for Information Security (BSI), the National Cryptologic Center (CCN) and Graz University of Technology are accompanying the Charter’s work as Associated Partners. Today, the Charter of Trust is gaining two new members in NTT, a Japan-origin IT consulting and managed service provider, and the German semiconductor manufacturer Infineon Technologies AG. With the Hasso Plattner Institute for Digital Engineering GmbH (HPI), one of Germany’s leading IT institutes is now also contributing to the cybersecurity initiative as an Associated Partner.

Last year, the partners already agreed on 17 concrete baseline requirements with which they can increase the security of their supply chains. Since then, numerous suppliers of CoT companies have already committed to meeting these requirements.

Siemens has been introducing them step-by-step since February 15, 2019, and they have been internationally anchored and made binding as part of the general ordering conditions. This primarily affects suppliers of safety-critical components – such as software, processors or electronic components. Existing suppliers are expected to implement the requirements gradually if they are not already being fulfilled. The aim is to better protect the digital supply chain from hacks. The baseline requirements include, for example, that suppliers incorporate safety standards, processes and methods into their products or services. This concerns both technical features and organizational measures relevant to products, services and the corresponding IT infrastructure. The goal here is to reduce risks caused by weaknesses in the software and malware. Suppliers bear the responsibility to carry out regular safety checks, tests and corrections. The CoT partners have agreed to these requirements for themselves as well. The supply chain is the weakest point in a company’s cybersecurity ecosystem: The origin of 60 percent of cyberattacks can be traced back to parts of the supply chain, and in 60% of those cyber incidents, it is smaller companies who are affected, according to a Verizon study.

The CoT partners have also decided to promote education and training on cybersecurity issues, including for small and medium-sized enterprises (SMEs), which are increasingly targeted by cyberattacks. For example, in Germany, the Charter of Trust partnered with the “Alliance for Cybersecurity,” and developed a set of materials with an emergency card that explains quickly and easily what to do in the event of a cyberattack. In addition, the partners have developed further training material that are made available to SMEs free of charge. In doing so, they aim to prevent cybercrime, but above all to highlight the opportunities for effective cybersecurity measures. The partners have developed a special cybersecurity simulation for schools to give students and teachers a clear and easily digestible overview of the challenges.

According to the Center for Strategic and International Studies, cyberattacks will cause more than €500 billion in global damage in 2018. And the threats are constantly increasing in a digitalized world: According to Cisco, there are around 50 billion networked devices in use in 2020 – double the amount than in 2015, and the figure is expected to rise to 500 billion by 2030.

You may also like

UK/EU Summit - “Risk to Resilience”
icon External Engagement

UK/EU Summit - “Risk to Resilience”

Detlef Houdeau, Senior Director, Business Development at Infineon Technologies was a speaker at the inaugural UK/EU Summit organized by our newest Associated Partners Shared Assessments.

💡Under the theme “Risk to Resilience” the first event of this series was held in London and brought together professionals from different industries and regions. Detlef participated in the panel about the complex regulatory landscape and emphasized that new legislation like the EU AI Act, DORA and Hashtag#NIS2 continue to push the standard of care on cybersecurity and other risks.

Thanks to Shared Assessments for organizing such an amazing event and inviting the Charter of Trust to participate in this high-class panel alongside Andrew Moyad, CEO at Shared Assessments.
October 08, 2024
36th Cyber Security Day: Working together for more resilience in the digital future
icon External Engagement

36th Cyber Security Day: Working together for more resilience in the digital future

Strong networks and effective cooperation are the key to successfully shaping the digital future in Germany. Cybersecurity is a team effort, and that was again visible last week at the 36th Cyber Security Day in Berlin.

🌐On 26 September 2024, the Bundesamt für Sicherheit in der Informationstechnik (BSI), Alliance for Cyber Security, and the DIHK invited experts, companies, authorities and political decision-makers to jointly strengthen Germany's cyber resilience.

The event was a great mix of policy debate, practical exchange, workshop and networking under the motto ‘Stronger Together: Greater Resilience through Cooperation’.

✨ One of the highlights of the day was the closing panel with Claudia Plattner, President of the BSI, Dr. Stefan Saatmann, Deputy Head Berlin Office at Siemens, Konstantin von Notz, Member of the Bundestag for B90/Greens, and Alexander von Gernler, German Informatics Society, interchanging ideas to foster resilience through collaboration. Initiatives like the CoT baseline requirements and its huge potential for international harmonizing cybersecurity regulations were discussed as well.

Let’s all work together so that closer cooperation between the BSI and businesses bring more tangible effects to increase digital resilience. Special thanks to Nils Hasenau for providing the excellent photos and also to Simon Ulmer and Ralf König for attending the event.
October 01, 2024
Nordic Cyber Summit 2024
icon External Engagement

Nordic Cyber Summit 2024

The Charter of Trust at the Nordic Cyber Summit
What a great opportunity for Morten Kromann, Head of Industrial Security Denmark at Siemens, to present the Charter of Trust perspective on cybersecurity regulations like Hashtag#NIS2 at the Nordic Cyber Summit in Copenhagen.

This year the summit was again a formidable event to engage with top cybersecurity experts, share insights, and discuss strategies to navigate the ever-evolving threat landscape in the Nordic region with the theme “Fortifying the Future: Building Cyber Resilience in a Transformed World”.

A main aspect highlighted by Morten was the discrepancies between the NIS2 directive’s incidents reporting timeframe and related provisions adopted in other legislations. These regulatory overlaps create difficult compliance environments for industry and costly operational pressures which add to the fragmentation of the market instead of harmonizing it. That is why the Charter of Trust emphasizes streamlining reporting requirements stemming from these different legislative frameworks and developing single entry points for reporting on the national level.

These and more points have been discussed during our Security-by-default Webinar on the 29th of October. See the events section on this website to find the recording of the webinar.
September 16, 2024