Secure Flash: A Practical Path to Cyber Resilience Act Compliance

This week at Electronica 2026, Winbond is showcasing its Secure Flash offerings, along with other technology and products. Come by and visit Winbond in Hall B5, booth 360. In this article, we’ll share the details of Winbond’s new conformance and integration Kit announced last week ahead of Electronica. Then we’ll dive into how Winbond’s Secure Flash technology provides a practical way to ensure compliance with the Cyber Resilience Act (CRA).

Kit for CRA Conformance and Integration

Last week Winbond announced its CRA Conformance and Integration Kit for its TrustME W77Q Secure Flash family. The package is designed to help manufacturers accelerate readiness for the European Union’s Cyber Resilience Act (CRA) by providing hardware security, software, integration guidance, testing resources, reference designs, and security evidence in a unified package.

According to the company, the CRA introduces cybersecurity requirements across the lifecycle of products with digital elements, covering areas including secure design and development, production, vulnerability handling, software maintenance, and technical documentation. Winbond’s CRA Conformance and Integration Kit helps customers translate these requirements into implementation and system-level verification activities.

Winbond’s TrustME Secure Flash products meet a variety of key security certifications.

TrustME W77Q Secure Flash has achieved SESIP Level 2 certification, providing independently assessed security evidence to support customers in evaluating the component's security and their own product-level compliance activities. Component-level certification does not by itself establish CRA conformity of the finished product.

For platforms already using external NOR Flash, W77Q can provide a practical migration path where package, voltage, interface, and system requirements align. While integration may require hardware and software changes, W77Q can strengthen external memory security without adding a separate security component or requiring a complete platform redesign.

Secure Flash as the Hardware Root of Trust for CRA-Ready Connected Products

As connected products become increasingly prevalent, manufacturers must protect firmware and sensitive data while ensuring that vulnerabilities can be addressed throughout a product’s lifecycle. The European Union’s Cyber Resilience Act (CRA) raises the bar for cybersecurity, requiring manufacturers to address security risks across product design, development, production, and maintenance.

Winbond TrustME® Secure Flash, including W77Q Secure Flash family, provides hardware-based security mechanisms within the external memory subsystem. By helping protect firmware, control access to critical data, and support secure update and recovery processes, Secure Flash offers a practical foundation for strengthening existing product designs and preparing the technical evidence needed for CRA assessments.

Understanding CRA Requirements and Timelines

The CRA establishes cybersecurity requirements for products with digital elements placed on the EU market. Depending on the product’s risk profile, manufacturers must address areas such as protection against unauthorized access, data integrity, secure updates, vulnerability handling, and continued security maintenance.

The main CRA provisions apply from December 11, 2027. However, Article 14 vulnerability-reporting obligations apply from September 11, 2026. Manufacturers therefore need to establish processes for vulnerability reporting, remediation, testing, and documentation well before the main provisions take effect.

Compliance is not simply a matter of selecting a secure component. It requires a product-level approach that connects technical controls with risk assessments, verification results, vulnerability-management procedures, and ongoing support commitments.

Strengthening Existing Designs with Secure Flash

Conventional Flash primarily stores firmware and data, but a compromised memory subsystem can expose critical software and security information to unauthorized modification. Secure Flash introduces additional security mechanisms at this boundary, helping reduce reliance on application software alone to enforce security policies.

For compatible designs, W77Q can replace conventional NOR Flash with limited board changes and may retain the existing footprint. This approach can reduce redesign effort while allowing manufacturers to incorporate stronger memory-level security into established platforms.

Depending on the device configuration and system implementation, Secure Flash can contribute to several key security objectives:

• Secure boot and firmware integrity: Help authenticate stored firmware and establish a trusted startup process.
• Protected access: Restrict unauthorized access to designated memory regions and security-sensitive operations.
• Authenticated updates and rollback protection: Verify update authenticity and support version controls that prevent the reintroduction of vulnerable firmware.
• Secure recovery: Support protected recovery mechanisms when primary firmware becomes corrupted or fails verification.
• Confidentiality and data protection: Protect designated assets through supported access-control and cryptographic mechanisms.
• Remote attestation: Contribute to evidence of device identity, configuration, or measured security state when supported by the complete system architecture.

These capabilities can help reduce the amount of security logic that must be developed entirely in application software. However, realizing their benefits requires appropriate configuration, provisioning, software integration, and system-level verification.

Designing Secure Updates and Reliable Recovery

Secure firmware updates are essential to maintaining product security throughout its lifecycle. A valid digital signature confirms the authenticity and integrity of an update, but does not necessarily prevent the installation of an older, vulnerable version. Effective update mechanisms must therefore combine image authentication with persistent version-control policies.

A robust update process should validate the update package, verify its signature and compatibility, check version requirements, and confirm the programmed image before switching execution to the new firmware. It should also account for power interruptions and failed updates, ensuring that the device retains an authorized boot or recovery path.

Recovery mechanisms require similar care. A recovery image should be authenticated and governed by a defined update policy. An outdated recovery image can reintroduce known vulnerabilities, so manufacturers must ensure that recovery procedures remain consistent with the product’s approved security baseline.

Secure Flash can provide important building blocks for these processes, but the host processor, boot architecture, update software, and operational procedures must work together to enforce the intended security policy.

Building Evidence for CRA Assessments

The CRA requires manufacturers to demonstrate that their products address applicable cybersecurity requirements. Secure Flash can support this effort when its security functions are mapped to product-level objectives and verified through documented testing.

A structured technical evidence package should include:

• Security architecture: Document trust boundaries, protected assets, boot sequences, update flows, and recovery paths.
• Device configuration: Record the selected part number, revision, enabled security mechanisms, access permissions, and provisioning policies.
• Verification results: Retain tests covering authentication failures, unauthorized commands, rollback attempts, interrupted updates, and recovery scenarios.
• Supplier assurance: Maintain relevant datasheets, security guidance, certification reports, and product-specific documentation.
• Operational procedures: Document key management, update authorization, vulnerability handling, incident escalation, and end-of-support arrangements.

Winbond W77Q has achieved SESIP Level 2 certification. Such component-level assurance can help reduce duplicated assessment work, provided the certificate’s scope and assumptions match the specific device, configuration, and security functions used.

Nevertheless, component certification does not automatically establish conformity for the finished product. Manufacturers remain responsible for their overall security architecture, residual risks, verification activities, and applicable conformity assessment requirements.

Accelerating Integration with the Winbond CRA Integration Kit

To help bridge the gap between hardware security capabilities and product-level implementation, Winbond’s CRA Integration Kit brings together integration guidance, software resources, testing support, and compliance documentation.

The package is designed to help engineering teams connect security requirements with implementation and verification activities. Its proposed elements include application notes for mapping requirements to security controls, hardware integration guidelines, low-level drivers, sample code, test suites, conformity checklists, and reference designs.

These resources can help teams identify which protections are enforced by hardware and which depend on host software or operational processes. Repeatable tests and structured documentation can also make security verification more consistent and help organize evidence for internal assessments or third-party conformity evaluations.

The precise availability and applicability of individual resources should be confirmed with Winbond, along with the supported devices, software platforms, and integration requirements.

A Practical Foundation for Cyber Resilience

CRA readiness requires more than adding a security feature to a product. Manufacturers must integrate security into the complete product lifecycle, from initial architecture and manufacturing provisioning to software updates, vulnerability response, and end-of-life handling.

Winbond TrustME® Secure Flash provides hardware-based security building blocks that can strengthen the external memory boundary without requiring a separate security device. Combined with appropriate host integration, system verification, and lifecycle processes, W77Q and the Winbond CRA Integration Kit can help manufacturers strengthen product security and organize the evidence needed for CRA assessments.

By addressing security early and establishing repeatable integration and verification practices, manufacturers can better prepare their connected products for evolving cybersecurity requirements while minimizing unnecessary redesign effort.