Winbond Introduces CRA Conformance and Integration Kit for TrustME® W77Q Secure Flash to Support EU Cyber Resilience Act Readiness

PR Newswire · 3d ago

TAICHUNG, Taiwan, Nov. 4, 2026 /PRNewswire/ -- Winbond Electronics Corporation, a leading global supplier of semiconductor memory solutions, today announced the CRA Conformance and Integration Kit for its TrustME® W77Q Secure Flash family. The package is designed to help manufacturers accelerate readiness for the European Union's Cyber Resilience Act (CRA) by providing hardware security, software, integration guidance, testing resources, reference designs, and security evidence in a unified package.

CRA Conformance and Integration Kit for TrustME® W77Q Secure Flash to Support EU Cyber Resilience Act Readiness

The CRA introduces cybersecurity requirements across the lifecycle of products with digital elements, covering areas including secure design and development, production, vulnerability handling, software maintenance, and technical documentation. Winbond's CRA Conformance and Integration Kit helps customers translate these requirements into implementation and system-level verification activities.

TrustME® W77Q Secure Flash has achieved SESIP Level 2 certification, providing independently assessed security evidence to support customers in evaluating the component's security and their own product-level compliance activities. Component-level certification does not by itself establish CRA conformity of the finished product.

For platforms already using external NOR Flash, W77Q can provide a practical migration path where package, voltage, interface, and system requirements align. While integration may require hardware and software changes, W77Q can strengthen external memory security without adding a separate security component or requiring a complete platform redesign.

CRA Conformance and Integration Package

The W77Q CRA Conformance and Integration Kit brings together key resources to support implementation, testing, and documentation, including:

CRA Security Objective Mapping: Maps relevant CRA Annex I security objectives to W77Q security capabilities.
Hardware Integration Guidelines: Provides guidance for integrating W77Q as an external NOR Flash solution while minimizing board-level changes.
Low-Level Security Library and Sample Code: Provides software components and examples for secure storage, authentication, software updates, recovery, and lifecycle management.
CRA Integration Test Suite: Includes positive and negative test scenarios and reusable test cases for system verification.
CRA Conformance Collateral: Provides risk-assessment templates, vulnerability-handling and supply-chain documentation, security characteristics, and reusable security evidence.
Conformity Checklist and Reference Designs: Provides implementation guidance and reusable examples combining W77Q with selected MCU platforms.
Open-Source Resources: Includes selected open-source implementations, Linux reference drivers, and remote secure software-update components.

Supporting Long-Lifecycle and Post-Quantum Security

The CRA Integration Kit also builds on Winbond's post-quantum cryptography (PQC) work for Secure Flash. Supported W77Q devices use the Leighton-Micali Signature (LMS) scheme specified in NIST SP 800-208 to authenticate firmware and software updates.

W77Q security capabilities—including protected storage, authenticated software updates, version enforcement, rollback protection, and recovery—support security throughout the product lifecycle. These capabilities can help OEMs address security requirements for long-life connected products while providing a path to PQC-protected update authentication where supported by the selected device and system architecture.

"The Cyber Resilience Act makes cybersecurity a lifecycle responsibility. Our CRA Conformance and Integration Kit brings together Secure Flash, software, validation assets, and reusable security evidence to help customers integrate security functions and document their designs. W77Q's SESIP certification provides independent assessment of the component, helping customers establish a stronger foundation for their own product-level compliance activities," said Winbond.

"Complying with the EU Cyber Resilience Act (CRA) is challenging because manufacturers must verify how third-party components meet system-level security requirements. Winbond's W77Q Secure Flash and CRA Integration Kit solve this challenge by providing hardware-enforced security capabilities alongside comprehensive integration guidance, testing tools, and structured documentation. This ready-to-use compliance evidence streamlines the due diligence process and significantly reduces the engineering effort required for both internal self-assessments and third-party conformity audits," said José Pulido, Director at jtsec Beyond IT Security.

The Winbond CRA Conformance and Integration Kit is designed for connected products across industrial automation, Industrial IoT, networking, smart building and access control, HVAC, energy, EV charging, smart appliances, and other applications requiring secure lifecycle management and CRA readiness.

For more information about Winbond Secure Flash products and solutions, please visit the Winbond website.

About Winbond

Winbond was established in September 1987 and listed on the Taiwan Stock Exchange in 1995. The company is headquartered at the Central Taiwan Science Park (CTSP) in Taichung, Taiwan, and operates two highly automated and intelligent 12-inch wafer fabs in Taichung and Kaohsiung. Winbond is committed to providing comprehensive integrated circuit solutions to customers worldwide, with major product lines including Code Storage Flash, Customized Memory Solution (CMS), and various logic IC solutions.

Winbond is a registered trademark of Winbond Electronics Corporation. All other trademarks and copyrights mentioned herein are the property of their respective owners.

Contact:

Nicole Conley

Tanis Communications for Winbond

831-713-9076

nicole.conley@taniscomm.com