The Shift to Remote Power Management and Associated Risks

Modern power infrastructure has transitioned from isolated, on-site hardware to highly connected, remotely monitored systems. CyberPower's product portfolio spans several critical categories:

  • Uninterruptible power systems (UPS)
  • Power distribution units (PDUs)
  • Power management software
  • Surge protectors
  • Power converters
  • Network cards
  • Environmental sensors

As these devices are integrated into corporate networks to enable remote monitoring and centralized management, they provide operators with real-time visibility into equipment status. However, this network connectivity also introduces potential vulnerabilities. Access controls, software updates, and firmware integrity become primary targets for cyber threats. For organizations managing data centers and critical infrastructure, selecting suppliers who can mitigate these risks while maintaining operational efficiency is essential for long-term business continuity.

Understanding the IEC 62443-4-1 Standard

The IEC 62443-4-1 standard is a core component of the international IEC 62443 series, which governs cybersecurity for industrial automation and control systems. Rather than focusing solely on the technical specifications of a finished product, this standard defines the requirements for a secure product development lifecycle. The certified process covers several key phases:

  • Security requirements definition
  • Secure design and implementation
  • Security verification and validation testing
  • Security issue management
  • Patch management and vulnerability remediation
  • Product end-of-life management

By establishing clearly defined responsibilities and documented procedures, the framework ensures that manufacturers can systematically track security requirements during the initial development phase and address newly discovered vulnerabilities after the equipment has been deployed.

Executive Perspectives on the Certification

The certification highlights a strategic alignment between power equipment manufacturers and independent security assessors. Hundry Chien, Assistant Vice President of CyberPower's Data Center Development Division, emphasized the importance of long-term security in data center environments:

"Data centers depend on reliable power and management equipment that can be safely operated and maintained over time. By incorporating cybersecurity into our product development processes, we give our R&D teams a consistent framework for design, testing, and subsequent updates. This certification recognizes our commitment and helps customers better understand how we manage cybersecurity risks throughout the product lifecycle."

Maxi Tsai, General Manager of DEKRA APAC DTS and Onward Security, noted the direct link between connected infrastructure and business resilience:

"The cybersecurity of connected power equipment is closely linked to business continuity. An effective secure development process makes risk identification, security testing, and vulnerability management part of day-to-day work, supported by traceable records. CyberPower's successful assessment provides customers with independent evidence to assess a supplier's cybersecurity management and long-term maintenance capabilities, alongside equipment performance and power supply reliability."

DEKRA's Role and the Regulatory Landscape

The assessment was conducted by DEKRA, which leverages its local cybersecurity expertise in Taiwan alongside global testing and certification resources. Beyond the IEC 62443 secure development process assessments, DEKRA provides product-level cybersecurity testing and certification services.

This expertise is increasingly relevant as international regulatory frameworks tighten. For instance, under the EU Cyber Resilience Act (CRA), DEKRA offers specialized services to help manufacturers navigate compliance, including:

  • Assessing regulatory applicability
  • Conducting gap analysis
  • Reviewing vulnerability management and incident reporting procedures
  • Supporting the creation of technical documentation

By evaluating both development processes and product security capabilities, DEKRA assists manufacturers in aligning their existing cybersecurity practices with international market and regulatory requirements, thereby reducing compliance risks during product launches and ongoing maintenance.