Helping tado° to be prepared for the Cyber Resilience Act
Challenge
tado° wanted to understand how its existing product security practices and documentation aligned with CRA requirements and identify opportunities to strengthen their products and processes.
Approach
Resillion combined independent security testing of tado°’s connected thermostat with a review of its CRA readiness, documentation, risk assessments and security processes.
Results
tado° gained clearer insight into potential risks and practical recommendations to strengthen its processes and prepare for future CRA conformity assessment.
About tado°
tado° is one of Europe’s leading intelligent home energy management companies, helping households reduce energy consumption and lower heating costs through smart thermostats, heat pump optimisation and connected energy services. Headquartered in Munich, the company develops smart home technology designed to make homes more energy efficient while supporting Europe’s transition to cleaner energy.
As millions of connected devices become part of everyday life, maintaining customer trust is just as important as delivering innovation. Protecting connected products against cyber threats is increasingly becoming a competitive advantage as well as a regulatory requirement.
Preparing for a new era of product cyber security
The EU Cyber Resilience Act (CRA) introduces new mandatory cyber security requirements for products with digital elements, requiring manufacturers to demonstrate secure development practices, robust vulnerability management and evidence-based security testing throughout the product lifecycle.
Like many innovative companies, tado° wanted to ensure its existing security practices aligned with the new requirements introduced by the Cyber Resilience Act.
As the Cyber Resilience Act continues to evolve, tado° wanted to benchmark its existing security and development processes against emerging guidance and understand where further enhancements could support future compliance.
Cyber security has been a priority for tado° from the outset, as well as a key concern for its customers. Connected devices installed inside people’s homes must not only perform reliably but also protect personal information, prevent unauthorised access and maintain trust in the wider smart home ecosystem.
tado° chose to assess its position early, validate its approach and identify opportunities to further strengthen both its products and supporting processes.
OUR APPROACH
Combining product security testing with Cyber Resilience Act readiness
As part of the European CRACY project – an EU-funded initiative supporting manufacturers preparing for the Cyber Resilience Act – Resillion worked with tado° to provide an early readiness assessment, combining technical product testing with documentation review and practical security guidance.
Turning CRA intent into practical action
CRACY, short for “CRA Compliance made easY”, is designed to help manufacturers interpret Cyber Resilience Act requirements and apply them to real products through practical guidance, tooling and CRA-style self-assessments.
Resillion is involved because of its experience in product security testing and assurance, and because it leads the CRACY work package focused on tooling. In practice, this means building and validating CRA-aligned test approaches, coordinating how tooling contributions fit together, and feeding lessons from pilots back into improvements that can support the wider manufacturing community.
Drawing on decades of experience in product testing and certification, Resillion helped tado° understand both the technical and procedural evidence likely to be required under the new legislation.
Product interface security testing
Resillion carried out practical security testing on tado°’s connected thermostat, focusing on the device’s external communication interfaces.
Testing included:
Wi-Fi interface security testing
Bluetooth interface security testing
Automated fuzz testing
Authentication and protocol spoofing
Packet flooding and resilience testing
Validation of device behaviour under unexpected or malicious conditions
Rather than simply checking functionality, the testing assessed how the device responded when exposed to behaviours that could be used by attackers to disrupt services or gain unauthorised access.
Cyber Resilience Act documentation review
Alongside technical testing, Resillion reviewed the documentation and evidence that supports Cyber Resilience Act compliance.
This included reviewing:
- CRA applicability and product classification
- Product risk assessments
- Security documentation
- Evidence supporting secure development practices
- Vulnerability management considerations
Where improvements were identified, Resillion provided practical recommendations to help strengthen documentation and ensure relevant risks had been fully considered.
Cyber security has always been a core part of how we develop connected products. As the Cyber Resilience Act introduces new regulatory expectations, we wanted independent validation that our products, processes and documentation were aligned with emerging requirements. Working with Resillion provided valuable external insight and helped us identify opportunities to further strengthen our readiness for future compliance.”"
Why this mattered
Unlike many regulatory frameworks, the Cyber Resilience Act is not simply a checklist of technical controls.
Manufacturers must show that cyber security has been considered throughout the entire product lifecycle – from identifying risks and implementing secure development practices to validating products through testing and maintaining processes for responding to future vulnerabilities.
Even for organisations with mature product security programmes, the Cyber Resilience Act introduces new expectations around documentation, evidence and ongoing assurance. Independent assessment can help validate existing practices while identifying opportunities for continuous improvement.
By combining practical testing with certification expertise, Resillion helped tado° gain an earlier understanding of both their product security posture and their readiness for future compliance.
One of the biggest misconceptions about the Cyber Resilience Act is that it's simply another compliance checklist. It isn't. Security depends on how every part of a product works together throughout its lifecycle. Our role is to help manufacturers understand where the real risks are, validate how products behave under attack, and provide practical guidance that supports both stronger security and future compliance
RESULTS
Through the pilot engagement, tado° gained valuable insight into both the technical security of its connected products and the wider organisational requirements introduced by the Cyber Resilience Act.
The engagement provided:
- Independent validation of Wi-Fi and Bluetooth security
- Independent validation together with recommendations to further strengthen documentation and supporting processes
- Improved understanding of product-specific cyber risks
- Practical recommendations for development teams
- Greater confidence in preparing for future CRA conformity assessment
- Stronger foundations for secure product development and future innovation
Most importantly, the engagement provided independent validation of tado°’s existing approach while helping strengthen readiness ahead of future CRA compliance requirements
Looking ahead
As Cyber Resilience Act deadlines move closer, manufacturers across Europe are increasingly recognising that compliance requires far more than interpreting legislation.
Success depends on combining practical security testing, robust engineering processes and the evidence needed to demonstrate that cyber security has been embedded throughout product development.
Through the CRACY programme and its product testing and certification expertise, Resillion is helping manufacturers move from CRA uncertainty to practical action. By combining guidance, tooling, real-world pilots and independent assurance, we help teams understand what is expected, identify where they stand and build stronger foundations for secure-by-design products.
