We document our cybersecurity work openly where possible: principles, conventions, compliance notes, release evidence, and practical engineering habits.
Cybersecurity Coding Conventions
Secure coding guidance for engineering teams, including conventions and practices that make code easier to review, maintain, and secure over time.
Cybersecurity Knowledge Base
Our broader cybersecurity space for notes, references, processes, and evolving working agreements around security, compliance, and engineering practice.
Release Automation Tools Compliance
Cybersecurity is not only about source code. It also affects how releases are built, checked, documented, packaged, and published. Our RAT compliance page explains how Release Automation Tools can support traceable release processes, automated checks, repeatable builds, and evidence generation for regulated or security-conscious engineering environments.
Workshops We Are Currently Developing
The following workshop formats are being developed from our internal cybersecurity work, client conversations, release automation experience, and conference material.
Intro to the EU Cyber Resilience Act
A practical introduction for software engineering and development teams: what the Cyber Resilience Act means for software, release processes, documentation, and post-release responsibilities.
ISM for Small Teams
Information Security Management (ISM for short): Responsibilities, playbooks, evidence, habits, and practical ISMS implementation without enterprise overhead.
HSE Way of Working
Practical engineering workflow for LabVIEW teams: Git, issue tracking, DokuWiki, reviews, release checklists, and effective development habits.
Secure Release Management
Practical controls for secure automated releases: static analysis, unit tests, SBOM, Declaration of Conformity inputs, artifact integrity, and controlled publishing.
How We Approach Cybersecurity Work
We usually start with a short team assessment, then connect CRA and security expectations to your real engineering workflow. From there, we look at small-team ISMS habits, HSE's Way of Working, Git and issue tracking, release automation with RAT, and the evidence needed for controlled releases.
Assess
Team assessment and current workflow review.
Translate
CRA / NIST / CMMC context in practical engineering language.
Structure
Small-team ISMS, playbooks, and DokuWiki documentation.
Trace
Source code control, issue tracking, reviews, and traceability.
Automate
DevOps / DevSecOps with RAT-based release automation.
Evidence
Tests, static analysis, SBOM, release artifacts, and Declaration of Conformity inputs.
Talks and Community Contributions
We use conference talks and community events to share what we learn while applying cybersecurity practices in small engineering teams.
Small Company, Big Threats: CS for the Rest of Us
GDevConNA 2025
A practical report from our internal cybersecurity journey: what we learned, what we implemented, and how small companies can approach CRA, NIST, and long-term security work.
HSE's Journey towards Information Security
Test System Security Summit
We presented cybersecurity as a practical engineering concern for test systems, not an isolated IT activity. The focus: secure development habits, release discipline, evidence, and the reality of small teams.
Presentations and Panel Discussions
NI Connect 2026
We will continue the discussion at NI Connect 2026 in Fort Worth, connecting cybersecurity with modern test engineering, collaboration, and real-world engineering workflows.
Cyber Resilience Act: Mandatory Reporting since September 11, 2026
The CRA's first major compliance milestone (2024/2847 - Article 14) has passed. Manufacturers of products with digital elements must now report actively exploited vulnerabilities and severe security incidents affecting their products. Initial notifications are required within 24 hours of becoming aware, followed by more detailed reports within defined deadlines.
For engineering teams, this means being prepared to identify affected products, assess vulnerabilities and incidents, trace dependencies, coordinate responses, and document decisions. Reliable vulnerability tracking and clearly defined response processes are essential for meeting these obligations, and provide a foundation for the broader CRA requirements taking effect in December 2027.