So, the title of this article needs some explanation. It’s a play-on-words with an anti-communist phrase used during the Cold War—”Better dead than red.” The thinking at the time was that it was better to be dead than a communist. As an interesting side note, the phrase has been attributed to the Nazi propagandist Joseph Goebbels, expressed in 1945—a fact few who repeated this slogan in the 1960s were likely aware of.

In this case, however, RED does not refer to communism. Instead, the abbreviation refers to the European Union’s radio equipment directive,¹ which establishes a regulatory framework for all products sold in the European Economic Area that incorporate a radio. While this directive has existed since 2014, it has previously been focused on topics such as safety, radio spectrum, interference, and co-existence with other radios. However, recent amendments to this directive have significantly expanded the original scope of RED and one Article (3.3) addresses new cybersecurity requirements.

I have good and bad news with regard to this directive. 

The bad news is the deadline for complying with these new requirements is Aug. 1, 2025, so those affected don’t have much time to address any work that is required to be accomplished or resolve concerns they may have.

The good news is regulated medical devices are exempt as they are covered under the EU’s Medical Device Regulation (MDR) and In Vitro Diagnostic Medical Device Regulation (IVDR). RED applies to the Internet of Things (IoT) and the Internet of Medical Things, however, so non-regulated healthcare products (i.e., under MDR or IVDR) would still fall under RED. For example, health and wellness devices would need to be compliant with the directive.

Also exempt from RED are legacy devices you have previously manufactured; only new products need to demonstrate compliance. The cybersecurity requirements are detailed in three provisions: Articles 3.3(d), (e), and (f).

Network Protection—Article 3.3(d)

This requirement aims to ensure radio equipment does not harm the network or its functioning, nor misuse network resources, causing an unacceptable degradation of service. Manufacturers must implement features that prevent their devices from disrupting the functionality of websites or services.

Personal Data and Privacy Protection—Article 3.3(e)

This article strengthens the protection of personal data and privacy. Manufacturers are required to implement measures that prevent unauthorized access to or transmission of consumers’ personal data. This is particularly crucial in an era where IoT devices collect and process vast amounts of personal information.

Anti-Fraud Measures—Article 3.3(f)

To reduce the risk of fraud, manufacturers must include features such as improved user authentication controls to minimize fraudulent electronic payments and monetary transfers. This requirement is especially relevant for devices that handle financial transactions or sensitive personal information.

Action Items

As the August deadline approaches, manufacturers and distributors need to take steps to ensure compliance with the RED cybersecurity requirements. 

Following are some key considerations:

• Thoroughly review and understand the specific requirements outlined in Articles 3.3(d), (e), and (f). Familiarize yourself with the EN 18031 series of standards, which, although not yet harmonized, were developed to meet the RED cybersecurity requirements. In particular:
• EN 18031-1 focuses on network protection—Article 3.3(d)
• EN 18031-2 addresses privacy concerns—Article 3.3(e)
• EN 18031-3 addresses fraud prevention—Article 3.3(f)

• Conduct a comprehensive risk assessment of your products. Identify potential vulnerabilities and areas where your devices might not meet the new requirements. This will help you prioritize your efforts and resources.
• Incorporate cybersecurity considerations into your product design and development processes. This may involve redesigning existing products or developing new ones that meet the RED cybersecurity requirements from the ground up.
• Implement rigorous testing procedures to verify your products meet the cybersecurity requirements. This may include penetration testing, vulnerability assessments, and other security-focused evaluations.
• Maintain thorough documentation of your compliance efforts. This should include risk assessments, design decisions, threat modeling, test results, and any other relevant information that demonstrates your product’s compliance with the RED cybersecurity requirements.

While the RED cybersecurity requirements are a significant step forward in improving the security of products, they also present with some challenges. 

• The delay in the publication of harmonized standards has created difficulties for companies attempting to comply with the directive. The EN 18031 series of standards, developed to meet the RED cybersecurity requirements, has not yet been harmonized, complicating the path to presumed conformity. However, testing can be performed in accordance with ETSI EN 303 645.
• •Implementing the necessary cybersecurity measures will increase development costs and schedules. 

The European Commission has also released the Cyber Resilience Act (CRA), which aims to establish common cybersecurity rules for connected devices and will take precedence in any conflicts with RED. However, the CRA is much more complex and stringent than RED.

Conclusion

The RED cybersecurity requirements represent a significant step forward in improving the security and privacy of radio equipment in the EU marketplace. While compliance may present challenges, it also offers an opportunity for manufacturers to differentiate themselves by prioritizing cybersecurity and building trust with their customers. If you’re accustomed to creating secure medical devices under the FDA and MDR requirements, RED will seem simple in contrast. However, it may be a bit of a surprise to IoT developers.

Reference

1. tinyurl.com/mpo250451

MORE FROM THIS AUTHOR: Mass Amnesia in Medical Device Cybersecurity

Christopher Gates is a recognized thought leader in medical device cybersecurity and the current co-chair for H-ISAC’s MDSC. He has more than 50 years of experience developing and securing medical devices and works with numerous industry-leading device manufacturers. He frequently collaborates with regulatory and standard bodies, including the CSIA, Health Sector Coordinating Council, H-ISAC, and Bluetooth SIG.