01
Secure boot and programming protection
SECURE BOOT
Secure boot for Linux / RTOS and protection settings during production programming.
EU CRA COMPLIANCE
EU CRA compliance support for embedded devices
For the EU Cyber Resilience Act (CRA), we support secure boot, software bill of materials (SBOM) management and vulnerability-handling processes for embedded devices with STM32, NXP i.MX and Rockchip, on Linux and RTOS.
Positive ONE supports EU CRA compliance for embedded devices on the technical side: secure boot, software bill of materials (SBOM) management and vulnerability-handling processes for STM32, NXP i.MX and Rockchip devices running Linux or an RTOS.
SCOPE
What we cover
DEVICE → SOFTWARE → OPERATION
02
SBOM management
SBOM
Identifying the software components in use and creating and maintaining the SBOM.
03
Vulnerability handling and reporting
INCIDENT
Processes from vulnerability intake to reporting, in view of the CRA reporting obligations.
04
OS and tool selection
PLATFORM
Selecting and introducing RTOSes with SBOM support and programmers with secure provisioning.
SCOPE
Scope and supported platforms (announced 8 September 2026)
| Service items | Gap analysis against CRA requirements, security architecture design, secure boot and software signing, PKI and certificate management, SBOM creation and vulnerability management, secure OTA updates, security testing, technical documentation |
|---|---|
| Supported SoCs | STMicroelectronics STM32 MCU and STM32MP; NXP i.MX 8M, i.MX 93 and i.MX 95; Rockchip RK3588, RK3588S and PX30 |
| Software configurations | RTOS, embedded Linux (Debian, Ubuntu, Yocto), Android, bare metal, bootloaders, and AMP configurations combining Linux / Android with an RTOS or bare metal |
| Key CRA dates (as stated at announcement) | 11 September 2026: reporting obligations for vulnerabilities and serious incidents begin; 11 December 2027: main requirements apply |
EVIDENCE
Published technical examples
| Product / project | Details (as announced) | Our role | Released |
|---|---|---|---|
| EU CRA compliance support service | See “Scope and supported platforms” above | Service provider | 2026.09.08 |
| PEmicro Cyclone / Cyclone FX secure programmers and incident-response guide | Encrypted image (eImage) programming, password protection, programming count and expiry limits; a published five-step guide to prepare for the reporting deadlines (24-hour early warning, 72-hour notification, final report) | Exclusive distributor in Japan; guide author | 2026.09.16 |
| SCIOPTA real-time operating system | SBOM in SPDX format, delivery verified by SHA-256 and PGP signature, MMU / MPU isolation; certified to IEC 61508 SIL3, ISO 26262 ASIL D and EN 50128 SIL4 | Exclusive distributor in Japan, integration support | 2026.09.18 |
BEFORE YOU CONTACT US
What to tell us before a consultation or quotation
- Product type and when you plan to sell it in the EU
- SoC and software configuration (OS, bootloader, open-source components)
- Current secure boot, signing and software update mechanisms
- Whether you have an SBOM and how it is produced
- Whether you have a vulnerability intake channel and internal reporting procedure
- How devices are programmed in production (in-house or contractor)
PROCESS
Development process
STEP 1
Consult & scope
Hearing of goals & constraints
STEP 2
Spec & quote
Design policy & scope fixed
STEP 3
Design & build
HW / SW / FPGA implementation
STEP 4
Verify & certify
Validation & compliance support
STEP 5
Produce & support
Mass production & ongoing support
WHY POSITIVE ONE
Why Positive ONE
W1
Embedded specialists since 2004
SINCE 2004
Head office in Shibuya and an office in Tama, Tokyo, plus an R&D center in Ho Chi Minh City — over 20 years in embedded development.
W2
62+ key clients
TRACK RECORD
62+ key clients and institutions across automotive, semiconductors and electronics, telecom and public research.
W3
Engineering plus technical trading
ENGINEERING × TRADING
Long-term supply and technical support for products from global vendors, also available through 11 major Japanese distributors.
This page describes technical support. Final decisions on legal conformity require review by your legal team or a notified body.
Related press releases (Japanese)
- 2026.09.08 EU CRA support service for STM32, NXP i.MX and Rockchip devices
- 2026.09.16 Secure programmers and an incident-response guide for CRA reporting
- 2026.09.18 SCIOPTA, an embedded RTOS for CRA compliance
Products and related pages
FAQ
Frequently asked questions
What does your EU CRA support cover?
Secure boot and programming protection, SBOM creation and maintenance, vulnerability intake and reporting processes, and selection of RTOSes with SBOM support and secure programmers.
Which platforms do you support?
Embedded devices with STM32, NXP i.MX and Rockchip, running Linux or an RTOS.
Do you decide legal conformity with the CRA?
No. We provide technical support; final decisions on legal conformity require review by your legal team or a notified body.
What information do you need for a quotation?
Whatever you know of the items listed under “What to tell us before a consultation or quotation” is enough to start. We can also begin with a gap analysis to map your current state and define the work needed.