- Resources
- Blog
- News
How to Choose CRA-Compliant eSIM and Secure Remote Management for Cellular IoT Products
Bee Hayes-Thakore Cybercrime is no longer a background risk for connected products. It is an economic force. Cybersecurity Ventures has estimated that cybercrime would cost the world $5.5 trillion annually by 2025, a figure larger than the GDP of most major economies. That is the context behind the EU Cyber Resilience Act. CRA compliance is not only a European regulatory project. It is a signal to the global market that connected products must be designed, maintained, updated, and evidenced as secure throughout their lifecycle.
For embedded developers and hardware manufacturers, the practical question is simple: how do you build a cellular product that can be trusted in the field, updated remotely, and supported with evidence when a vulnerability appears?
At Hardware Pioneers Max 2026, manufacturers, connectivity providers, compliance specialists, and IoT developers discussed a common challenge: building products that can meet CRA requirements from launch through long-term operation. The consensus was clear: CRA compliance must be designed from the start.
For cellular IoT products, one of the strongest starting points is eSIM.
Why CRA Compliance Is Now a Product Design Decision
CRA applies to products with digital elements made available on the EU market. It changes the baseline for manufacturers, importers, and distributors by making cybersecurity part of product conformity. That means secure design, vulnerability handling, technical documentation, update support, incident reporting, and supplier evidence all become part of the product lifecycle.
The dates matter. Reporting obligations for actively exploited vulnerabilities and severe incidents begin in September 2026. The main obligations apply from December 2027. Cellular products often take years to move from architecture to prototype, pilot, certification, production, deployment, and support. A device designed today may still be shipping, connecting, and receiving updates well after CRA obligations are fully in force.
The lesson is clear: if your product needs secure connectivity in the field, CRA readiness must influence your connectivity architecture now.
Why eSIM Matters for CRA-Compliant Cellular Products
eSIM does not make a product CRA-compliant on its own. No single component can do that. It can make several parts of CRA readiness easier to design, operate, and evidence.
An eSIM, or eUICC, protects the device’s connectivity identity and network credentials. These credentials allow the product to authenticate to the network, stay reachable, receive profile changes, and support lifecycle operations. In a connected product, that identity is not a side detail. It is part of the trust model.
For manufacturers, the value of eSIM lies in its integration into a mature security and provisioning ecosystem. Certified eSIM operating systems, GSMA security assurance, secure provisioning sites, SM-DP+ platforms, and eIM-based remote management give teams a more structured way to manage connectivity across the product lifecycle.
This becomes important when devices are deployed in hard-to-reach environments: smart meters, industrial gateways, healthcare devices, logistics trackers, agricultural sensors, energy systems, and other cellular IoT products that may run for five, seven, or ten years without a human nearby.
The Three Practical Standards Behind CRA Readiness
Formal CRA harmonized standards will continue to develop, and manufacturers should track the official process. Three established standards are useful starting points:
Reachability Analysis: Reducing False Positives in CRA Vulnerability Management
One of the biggest risks in CRA operations is alert fatigue. As soon as teams start generating SBOMs and running vulnerability scanners, they may receive hundreds or thousands of alerts. Some irrelevant. Some real. The challenge is to tell the difference quickly and defensibly.
A scanner can tell you that a package appears in an SBOM. It cannot always tell you whether the vulnerable function is compiled into the deployed image, reachable through an active code path, exposed over a cellular bearer, enabled in configuration, or mitigated by sandboxing, compiler hardening, secure elements, or network policy.
Reachability analysis turns vulnerability management from a noisy alert queue into an engineering decision system.
For CRA-ready cellular products, manufacturers should combine SBOM data, VEX records, firmware build metadata, runtime configuration, exposed interfaces, cellular bearer constraints, product variants, and ownership data. Each vulnerability should be triaged into one of four lanes:
Not present. Present but not reachable. Reachable but mitigated. Reachable with action required.
This mediation step is critical. It reduces false positives without hiding risk. It also creates the evidence trail compliance reviewers need: why the vulnerability did or did not apply, who approved the decision, what mitigation was used, and what changed when the product configuration changed.
How eSIM Supports Secure Remote Updates and Evidence
For CRA compliance, secure updates are not just about delivering new firmware. They are about proving that a product can be maintained securely over time.
In cellular products, eSIM remote management can support that goal by helping devices remain reachable, enabling profile lifecycle operations, and supporting secure provisioning changes across a fleet. With SGP.32, IoT eSIM architecture brings remote profile management to devices that may not have a user interface, may be power constrained, and may connect over limited networks such as NB-IoT or LTE-M.
This is why interrupted update handling matters. A compliant evidence trail should be able to show the current eSIM profile state, current or target version where available, the timestamp of the last successful update, the timestamp of the last interrupted update, the transaction ID, the reason for interruption, and the next remediation action.
For NB-IoT devices, teams should test remote management under real network behavior. A desktop integration test is not enough. Battery-powered devices may wake briefly, move between coverage zones, lose attach state, or resume operations hours later. If the eIM, IPA or eUICC implementation, and transport support non-SMS bearer behavior, retry, timeout, and recovery logic, remote management can be designed for those constraints. But it must be verified before production.
CRA Compliance for Manufacturers
The business opportunity is larger than avoiding penalties. Companies that can show secure lifecycle management can shorten procurement conversations, reassure enterprise buyers, support MVNO and connectivity partner due diligence, and reduce friction with test labs and certification teams.
That is why partner choice matters. A CRA-compliant cellular product is not only a device with a modem. It is a product backed by secure identity, secure provisioning, update evidence, vulnerability handling, and support processes that can survive the realities of deployed fleets.
How Kigen Helps Manufacturers Start Securely
Kigen helps manufacturers adopt secure cellular connectivity at scale. Its eSIM enablement suite supports SGP.32 IoT deployments with certified eSIM technology, secure provisioning, eIM capabilities, and developer tools for embedded teams.
Manufacturers can accelerate the path from prototype to production using certified eSIMs, flexible connectivity options, and tools to validate profile lifecycle operations and update compliance.
For developers, a portable C-SDK, reference implementations, test suites, and transport abstraction simplify integration and help ensure solutions remain secure, maintainable, and scalable over time.
Start With Security-by-Design, Then Build the Evidence
The Cyber Resilience Act is pushing manufacturers toward secure-by-design product development, where risk assessment, vulnerability management, evidence capture, and long-term update support are built in from the start.
For embedded developers, the priority is practical: track profile status, record update outcomes, preserve timestamps, capture version data, generate SBOMs, and use reachability analysis to reduce false positives.
For manufacturers, the right eSIM and secure remote management partner can make cellular products easier to secure, update, evidence, and trust.
Download the slides from our HW Pioneers Max campfire session, “Ready for CRA? Secure Remote Updates with eSIMs,” and explore practical guidance on Cyber Resilience Act (CRA) compliance, secure-by-design connectivity, vulnerability management, and how eSIM technology can help simplify security at scale.
