Avnet, Inc. · NASDAQ:AVT
Avnet — Technical Presentation (December 2025)
35 slides from Avnet's technical presentation, December 2025
Slide 1: Cyber Resilience Act
Cyber Resilience Act A game changer for the IoT Market Romain Tesnière – BDM EMEA Solution Sales
Slide 2: Some definitions
Some definitions Standard: international consensus of Regulation: rules made by an authority in order experts about how to do something. to control the way something is done, or the way people behave. Standard are produced by public/non-profit In the context of EU, organizations (ETSI, NIST, ANSI, I
Slide 3: Example of (European) regulations
Example of (European) regulations GDPR : General Data Protection Regulation RED : Radio Equipment Directive https://eur-lex.europa.eu/eli/reg/2016/679/oj https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014L0053 - Aims to protect EU citizen personal data. (in - Regulatory framework f
Slide 4: What is the CRA?
/ What is the CRA?
Slide 5: Products with digital elements shall be delivered without known exploitable vulnerabilities
“Products with digital elements shall be delivered without any known exploitable vulnerabilities”
Slide 6: What is the CRA?
What is the CRA? https://data.europa.eu/eli/reg/2024/2847/oj • It’s a legal framework Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October • It will 2024 on horizontal cybersecurity requirements • Ensure that products with digital elements for products with digital e
Slide 7: Some definitions (as per the Blue Guide)
Some definitions (as per the Blue Guide) https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:C:2022:247:TOC 2.2. Making available on the market • A product is made available on the market when supplied for distribution, consumption or use on the Union market in the course of a commercial activity
Slide 8: Products classification
Products classification • Critical Products Very High Risk & Very High Impact products • Important Products • Class II High Risk & High Impact products • Class I Medium Risk & Medium Impact products • Not listed (default) Products that do not have a core security function It’s NOT about the componen
Slide 9: Categories Technical Description as per EU/2025/2392
Categories Technical Description as per EU/2025/2392 https://eur-lex.europa.eu/eli/reg_impl/2025/2392/oj/eng Important Products of class I Critical Products • Identity and privileged access management systems • Hardware Devices with Security Boxes • Standalone and embedded browsers • Smart meter gat
Slide 10: Conformity Assessment Procedures (as per 768/2008/EC)
Conformity Assessment Procedures (as per 768/2008/EC) https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32008D0768 Module A: Internal production control Module C: Conformity to type based on internal production control • No notified body required • Manufacturer makes self assessment based •
Slide 11: Different assessments for each category
Different assessments for each category • Whatever the class, requirements are the same, the conformity assessment procedure differs • Default ➔ Self assessment is enough (use module A) • Class I ➔ Compliance to a harmonised standard (module A) or Third-party assessment (module B+C or module H) • Cl
Slide 12: Regulations & Harmonised standards
Regulations & Harmonised standards Harmonised standard: defined in 1025/2012 Article 2, point (1)(c) https://eur-lex.europa.eu/eli/reg/2012/1025/oj As per https://europa.eu/youreurope/business/product-requirements/compliance/conformity-assessment/index_en.htm :
Slide 13: Are there Harmonised Standards for CRA?
Are there Harmonised Standards for CRA ? Harmonised standard: defined in 1025/2012 Article 2, point (1)(c) https://eur-lex.europa.eu/eli/reg/2012/1025/oj EN18031 has been accepted (with restrictions) for the cybersecurity requirements of the RED directive (2014/53/EU) https://eur-lex.europa.eu/eli/d
Slide 14: What's in?
What’s in? Documentation Device Device Identity Device Access authentication management management • Open VS closed source • Risk assessments • One or two authentication • Public Key Infrastructure • Roles Based Access • List of harmonized EU • TLS • Certificate revocation Control (RBAC) cybersecuri
Slide 15: 13 cybersecurity requirements (Annex I.1)
13 cybersecurity requirements (Annex I.1) 1.Be made available on the market without known exploitable vulnerabilities; 2.Be made available on the market with a secure by default configuration, 3.Ensure that vulnerabilities can be addressed through security updates, 4.Ensure protection from unauthori
Slide 16: 8 vulnerability mngt requirements (Annex I.2)
8 vulnerability mngt requirements (Annex I.2) 1.Identify and document vulnerabilities and components contained in the product, 2.Address and remediate vulnerabilities without delay, including by providing security updates. Where technically feasible, new security updates shall be provided separately
Slide 17: Covered or not by the CRA?
Covered or not by the CRA ? • Not covered • Medical Devices (2017/746, 2017/745) • National Security & Defense • Automotive (2019/2144) • Aviation (2018/1139) • Marine (2014/90) • Anything covered by the NIS2 Directive (2022/2555) • Machinery-carrying vehicles • Covered • Machinery (as per 2023/1230
Slide 18: CRA timeline – It's now!
CRA timeline – It’s now! 2024 2025 2026 2027 December 11th November 28th June 11th September 11th December 11th Notified bodies Reporting Mandatory Technical description of critical, class I and class II products CRA enters into Technical Technical description of critical, class I and class II produ
Slide 19: Questions?
Questions? • Is my product concerned ? (trying to escape) ➔ YES, if that individual product was placed on the market after Dec 11th 2027 ➔ YES, if that individual product was placed on the market before Dec 11th 2027 AND it has received a SUBSTANTIAL update after Dec 11th 2027 (article 69) • Are pro
Slide 20: Other regulations
/ Other regulations
Slide 21: RED
RED https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014L0053 - Regulatory framework for placing radio equipment on the market (2014 -> 2022) - High-level cybersecurity requirements added in 2019 in Article 3: - (d) radio equipment does not harm the network or its functioning nor mis
Slide 22: CRA & RED: a common Security approach
CRA & RED: a common Security approach Radio Equipment Directive (RED) Cyber Resilience Act (CRA) Objective: Essential requirement for radio equipment Objective: Ensure Security over HW & SW products • EMC, Safety/health, privacy & fraud protection • Monitor vulnerabilities • Update mechanism for pat
Slide 23: US Cyber Trust Mark
US Cyber Trust Mark https://www.fcc.gov/CyberTrustMark - This is a voluntary program (not a regulation) - Scope: - The program applies to consumer wireless IoT products - Excluded from the program: - Medical devices regulated by the Food and Drug Administration - Motor vehicles and equipment regulat
Slide 24: What are the next steps?
AVNET / / What are the next steps ?
Slide 25: How to prepare and comply
How to prepare and comply • Read the CRA https://data.europa.eu/eli/reg/2024/2847/oj • Identify your products classes & your compliance strategy • Assess your security documentation level • Perform a risk assessment & threat analysis • Identify the proper security measures • Define & setup your vuln
Slide 26: AVNET Silica Value Proposition
AVNET Silica Value Proposition • Read the CRA https://data.europa.eu/eli/reg/2024/2847/oj • Identify your products classes & your compliance strategy • Assess your security documentation level • Perform a risk assessment & threat analysis • Identify the proper security measures • Define & setup your
Slide 27: Why Secure Provisioning Services?
Why SECURE PROVISIONING SERVICES?
Slide 28: Secure Provisioning is required for many use cases
Secure Provisioning is required for many use cases Every application that wants to comply with one or several of these use cases will require specific customisation (certificates & keys) AWS Connection IP Protection EV Charging Azure Connection Secure boot Wireless Charging (Qi) IoTConnect Secure Fi
Slide 29: Avnet Silica Warehouse
Avnet Silica Warehouse • Pros • Full control on what and how the provisioning is done DLM Server • Locks the device during transportation • Locks the device, then EMS just need to load FW • One-Stop-Shop (components + Services) • Cons • Requires customization content to be ready when shipping compon
Slide 30: Product Modification Center
Product Modification Center
Slide 31: PMC process flow
PMC process flow Goods Laser Programming Taping receipt marking Book parts against Programming according to Add a customer defined Repackage the parts in Delivery to PMC production order customer specification marking on the package reels Goods-out Carrier Book parts back to Transport & delivery Qua
Slide 32: Programming
Programming 10011110 11101110 1110010 Program parts according to customer specification with customer software.
Slide 33: Security Offer: From product to services
SECURITY OFFER From product to services 1. Secure 2. Secure MCUs & 3. Secure Provisioning 4. Public Key Elements MPUs services Infrastructure (PKI) Full range of companion Processing units Keys, certificates, Keys, certificates chips for authentication, embedding security bootloader, FW injection ma
Slide 34: Q&A
Q&A
Slide 35: INVNET sitica
INVNET sitica