The Charter-of-Trust (CoT) partners have agreed to deliver next-generation products with preset cybersecurity, following a clear “Security by Default” philosophy.

At present, there are no uniform regulations governing this issue – many products leave the factory solely dependent on safety systems that do not provide comprehensive protection. Users often have to adjust security settings afterward. As a first step, the Charter partner companies have now defined which security features should be present and activated by default in next-generation products – ranging from strong authentication features to a unique product identity and the requirement that passwords must be changed upon first use.

The CoT partners also believe that no undocumented functionalities or possibilities for remote connection should be part of initial device setup – another aspect that is not yet a general rule today. All these requirements are now being rolled out step by step within the relevant portfolios of the Charter of Trust member companies.

“Cybersecurity is a key ingredient for trust of our customers in all our businesses offering digitally connected products. It is also the basis for sustainable success and the foundation of a strong ecosystem “, says Roland Busch, deputy CEO, CTO, CHRO and Managing Board Member of Siemens AG.

At the Munich Security Conference in February 2018, Siemens and eight partners from the industrial sector launched a joint charter for more cybersecurity for the first time. Two years after signing, the Charter of Trust has grown to 17 members. In addition to Siemens and the Munich Security Conference, the companies AES, Airbus, Allianz, Atos, Cisco, Dell Technologies, Deutsche Telekom, IBM, Mitsubishi Heavy Industries, NXP Semiconductors, SGS, Total and TÜV SÜD have committed themselves to the document. Furthermore, the Federal Office for Information Security (BSI), the National Cryptologic Center (CCN) and Graz University of Technology are accompanying the Charter’s work as Associated Partners. Today, the Charter of Trust is gaining two new members in NTT, a Japan-origin IT consulting and managed service provider, and the German semiconductor manufacturer Infineon Technologies AG. With the Hasso Plattner Institute for Digital Engineering GmbH (HPI), one of Germany’s leading IT institutes is now also contributing to the cybersecurity initiative as an Associated Partner.

Last year, the partners already agreed on 17 concrete baseline requirements with which they can increase the security of their supply chains. Since then, numerous suppliers of CoT companies have already committed to meeting these requirements.

Siemens has been introducing them step-by-step since February 15, 2019, and they have been internationally anchored and made binding as part of the general ordering conditions. This primarily affects suppliers of safety-critical components – such as software, processors or electronic components. Existing suppliers are expected to implement the requirements gradually if they are not already being fulfilled. The aim is to better protect the digital supply chain from hacks. The baseline requirements include, for example, that suppliers incorporate safety standards, processes and methods into their products or services. This concerns both technical features and organizational measures relevant to products, services and the corresponding IT infrastructure. The goal here is to reduce risks caused by weaknesses in the software and malware. Suppliers bear the responsibility to carry out regular safety checks, tests and corrections. The CoT partners have agreed to these requirements for themselves as well. The supply chain is the weakest point in a company’s cybersecurity ecosystem: The origin of 60 percent of cyberattacks can be traced back to parts of the supply chain, and in 60% of those cyber incidents, it is smaller companies who are affected, according to a Verizon study.

The CoT partners have also decided to promote education and training on cybersecurity issues, including for small and medium-sized enterprises (SMEs), which are increasingly targeted by cyberattacks. For example, in Germany, the Charter of Trust partnered with the “Alliance for Cybersecurity,” and developed a set of materials with an emergency card that explains quickly and easily what to do in the event of a cyberattack. In addition, the partners have developed further training material that are made available to SMEs free of charge. In doing so, they aim to prevent cybercrime, but above all to highlight the opportunities for effective cybersecurity measures. The partners have developed a special cybersecurity simulation for schools to give students and teachers a clear and easily digestible overview of the challenges.

According to the Center for Strategic and International Studies, cyberattacks will cause more than €500 billion in global damage in 2018. And the threats are constantly increasing in a digitalized world: According to Cisco, there are around 50 billion networked devices in use in 2020 – double the amount than in 2015, and the figure is expected to rise to 500 billion by 2030.

You may also like

Contribution to the EU Commission Public Consultation on the revision of the Cybersecurity Act
icon External Engagement

Contribution to the EU Commission Public Consultation on the revision of the Cybersecurity Act

The Charter of Trust welcomes the opportunity to participate in the European Commission’s public consultation on the revision of the Cybersecurity Act. As a coalition united by the goal of strengthening digital trust, we are pleased to share our consolidated response and recommendations.

We support Policy Option 2, which focuses on targeted regulatory measures that address key challenges without creating unnecessary complexity. In this context, we emphasize the need to enhance the role and resources of ENISA, to ensure effective implementation of both current legislation and the European Cybersecurity Certification Framework (ECCF).

Our recommendations aim to improve transparency, collaboration, and efficiency across the EU’s cybersecurity landscape. These include:

- Introducing clear timelines for the development of certification schemes.

- Enhancing stakeholder engagement throughout the process.

- Establishing more structured communication channels between ENISA, the Stakeholder Cybersecurity Certification Group (SCCG), and sectoral ISACs (Information Sharing and Analysis Centers).

We call for a stronger ECCF, one that is transparent, inclusive, and aligned with international standards to foster global interoperability and ease compliance for organizations across borders. Equally critical is the harmonization of certification practices across EU member states and the mutual recognition of certifications to minimize regulatory fragmentation.

The Charter of Trust advocates for technically robust, standards-based certification schemes, with well-defined roles and responsibilities. We also stress the need for clarity on the interplay between voluntary and mandatory certifications, particularly in relation to the upcoming Cyber Resilience Act (CRA).

To streamline compliance and reduce administrative burden, we propose a unified, risk-based incident reporting regime that consolidates requirements under regulations such as NIS2, CRA, GDPR, and DORA. This would not only simplify reporting for organizations but also enhance the EU’s overall cyber resilience. In addition, we recommend incorporating liability protections and grace periods for incident disclosure.

Finally, we urge the Commission to strengthen supply chain security by adopting a risk-based classification approach and establishing baseline cybersecurity requirements for ICT suppliers.

The Charter of Trust remains fully committed to supporting the European Commission in shaping a secure, resilient, and trusted digital future for Europe. We look forward to continued collaboration in building a cybersecurity framework that meets the needs of all stakeholders, today and in the years to come.
June 19, 2025
Advancing Regulatory Alignment at RSA Conference 2025
icon External Engagement

Advancing Regulatory Alignment at RSA Conference 2025

In the face of rising global cyber threats, over 50 CISOs have called for greater international alignment of cybersecurity regulations to strengthen defenses and reduce fragmentation. This message was echoed at RSAC 2025, where experts from the OECD, European Commission, academia, and industry emphasized the need for principle-based collaboration. The Charter of Trust, a long-time advocate for regulatory harmonization, continues to support coordinated, effective approaches that prioritize clarity over complexity.
May 01, 2025
Richards Skalt takes over the Advocacy Workstream
icon External Engagement

Richards Skalt takes over the Advocacy Workstream

We are delighted to welcome Richard Skalt, Advocacy Manager at TÜV SÜD, as the new Leader of the Advocacy Workstream at the Charter of Trust. Richard steps into the role following María del Pino González-Junco, who recently assumed the position of Chair of the Global External Engagement Working Group.

With a strong background in advocacy and a forward-looking vision, Richard brings renewed energy to our mission of shaping a secure digital future. As he puts it:

“My motivation is to preserve and build upon the strong foundation of advocacy activities we’ve developed over the past years. At the same time, I’m committed to ensuring we’re in a position to shape the policies that will define how our business model and operations evolve in the future – including the cybersecurity of products and systems, the use, deployment, and distribution of robust AI solutions, as well as cloud security and secure datacenters.”

In a world defined by accelerating digital transformation and increasingly complex regulatory challenges, principled leadership and effective collaboration are more vital than ever. Under Richard’s leadership, the Advocacy Workstream will continue to engage policymakers, raise public awareness, and strengthen education around key issues such as cybersecurity, AI governance, and secure digital infrastructures.
April 29, 2025