Özer Koray Akdemir turns cybersecurity regulation into engineering work on connected products, and into the evidence that assessors ask for. He first did this when the regulation was still new and its interpretation was forming. The deadline was fixed, and the work ended in an approval audit.
What he brings to the Machinery Regulation
| What the Machinery Regulation asks for | Where the experience comes from |
|---|---|
| Malicious attempts in the risk assessment (Annex III, Part B, point 1; 1.2.1(a)) | Threat analysis and risk assessment (TARA) for connected products, from concept to production |
| Protection against corruption (1.1.9) | Architecture for signed software updates delivered over the air, with code signing, key management and PKI |
| Control systems that stay safe (1.2.1, 1.2.6) | Security requirements for embedded control units, including the safe reaction when secured communication fails |
| Components from suppliers | Cybersecurity requirements for suppliers and checks of what they deliver |
| Technical documentation (Annex IV) | Evidence prepared for approval audits and presented to assessors |
Before product cybersecurity, he spent many years on embedded systems, cryptographic systems and secure communications. That background shows in the kit, which treats security as a property of the whole machine: the controller, the gateway, the app, the cloud service and the people who service it.
Why the kit exists
Regulation (EU) 2023/1230 is the first EU machinery law with cybersecurity requirements. Sections 1.1.9 and 1.2.1 of Annex III ask machinery manufacturers to protect software, data and access hardware against corruption, to keep safety limits out of reach and to collect evidence of interventions. No harmonised standard covering these requirements has been cited in the Official Journal yet, so for now each manufacturer has to explain in its own technical file how it meets them. The kit is the structure he would give a machinery team on its first day: the documents in the order they are needed, each linked to the provisions it supports.
Principles
- Every template maps to provisions of the regulation.
- Standards are cited by number only; no standard text is reproduced.
- The kit helps you organise the work. It does not certify a machine or confirm that it conforms.
Education and frameworks
- M.Sc. in Electronics and Multimedia Signal Processing, Tampere University of Technology.
- B.Sc. in Electrical and Electronics Engineering, Bilkent University.
- Works with IEC 62443, ISO/SAE 21434, ISO 27001, UNECE R155 and R156, NIS2, the CRA and the Machinery Regulation.