Industrial companies connect machines, facilities and partners along value chains but cybersecurity often lags behind. This is precisely the challenge confronting the Manufacturing-X projects that grew out of Gaia-X. One example is the Semiconductor-X project: It is intended to enable companies in the value chain to exchange sustainability, production and process data securely and reliably in a data room.

CRA and NIS2: Road Map for Secure Industrial Data Rooms

Since companies’ roles and protected interests vary widely depending on the type of data, respective data owners ought to be able to establish and monitor the rules governing the use of their data. This is why machine-readable data use agreements are the basis for data exchange. , It is essential to enforces these agreements with technical actions to provide appropriate security guarantees.  This necessitates advanced security mechanisms, such as securing the software stacks used by means of trusted and confidential computing, particularly when data are highly sensitive.

The European legal framework requires a proactive and risk-based approach to cybersecurity too. The Cyber Resilience Act (CRA) imposes mandatory requirements on manufacturers and developers of gateways, while the NIS2 directive establishes standards for operators of federated services or hosted gateways. , Research scientists at Fraunhofer AISEC and IOSB are developing a road map for secure industrial data rooms together with the present Semiconductor-X partners. To this end, they are particularly identifying vulnerabilities and blind spots that still have to be closed for industrial use.

The research scientists are also developing specifications for data room gateways to process data of varying criticality levels and concepts for data room governance, such as processes for onboarding and certifying data room members . Another priority are guidelines for the secure development and operation of components and services. The goal is to produce context-independent results to enable direct transfer to other Manufacturing-X contexts. This will provide companies with practical guidance on creating their digital ecosystems securely from the outset.