Record components transparently
Product components and versions form the basis for further assessment.
Responsibility for software
does not end with delivery
Make components, licence terms and updates traceable.
Dependencies and forms of provision influence which evidence and measures a software product requires. Without an overview, assessing new vulnerabilities and licence obligations becomes laborious.
IQstruct Engineering supports the technical and organisational preparation of product requirements. Open source components are examined with regard to planned use, modification and distribution. An SBOM can complement the component overview. Manufacturer notices and updates are integrated into test and operating processes.
Start now at no cost
In a free first conversation we sort out which of your products fall under the regulation and which records are still missing for them.
Scope of services
Clarify licence terms before use
Relevant conditions are agreed with the customer.
Prepare updates
Testing, maintenance windows and rollback connect development and later operation.
Keeping an eye on components, licences and updates
IQstruct Engineering supports the technical and organisational preparation of product requirements, including those from the Cyber Resilience Act.
Before an open source component is used, we check the licence type, commercial use, modification, distribution and server-side provision. Copyleft licences such as the AGPL are distinguished from permissive licences such as MIT; relevant conditions are documented and agreed with you.
An SBOM complements the component overview and supports later vulnerability and update processes. Manufacturer notices and security updates are monitored and brought into operation via relevance, testing, release, rollout and rollback.
Product compliance
Responsibility for software extends beyond delivery
A traceable component overview makes it easier to assess new vulnerabilities and licence obligations.
Approach in the project
Ai1
Record digital products
Products with embedded software and their interfaces are recorded.
Ai2
Assess components
Software components, libraries and licences are listed in an SBOM.
Ai3
Monitor vulnerabilities
Manufacturer notices and CVE information are matched against the component inventory.
Ai4
Handle reporting channels
Incoming vulnerability reports are handled and forwarded in the ticket system.
Which form of use counts
Internal use
The software stays within your own company.
Distribution and modification
The product goes to customers with modified components.
Provision as a service
The software runs on the server side and is used over the network.
Scope boundary
Technical classification with legal supplement
Our documentation classifies components, licences and updates in a technically traceable way.
You clarify binding legal advice and final conformity decisions with your legal experts; our documents serve them as a basis.
Frequently asked questions
We are glad to answer your detailed questions in a personal conversation.
Does IQstruct Engineering take on the legal assessment?
The legal assessment lies with your legal advisers. IQstruct Engineering supplies the technical classification and documentation.
Is an SBOM mandatory?
Whether and in which form an SBOM is required depends on the product and the applicable requirements. We take it into account as part of the component documentation.
How do security updates get into the product?
Manufacturer notices are monitored; updates run via relevance assessment, testing, release, rollout and rollback.
Further industry solutions
Every industry has its particularities. That calls for a reliable partner who knows the requirements and delivers suitable solutions.
- AerospaceEvery change to an assembly draws a record behind it that stays findable for years.
- Electronics and semiconductorsA test bench measures in the microsecond range, and the piece count leaves no room for manual work.
- Special purpose machineryEvery machine comes about once, and its control code comes about with it.
First conversation
Arrange a free first conversation
Describe your task. We agree a date and discuss the possible project scope.
Ai1
You request an appointment
Ai2
We discuss your requirements
Ai3
You receive a quotation for the agreed scope
Philipp Niemann-StryczekManaging DirectorLeads the company on the commercial side and answers questions on IT/OT security, asset administration shells, compliance and research projects.
Free first conversation
Describe your task in the contact form. We come back with a proposed date.
Arrange a first conversationBooking calendar
The booking calendar appears here. It loads only after your consent, because your browser connects to Microsoft in the process.
Not quite what you need?
Discover further suitable services.
CI/CD and quality assurance
Combine automated tests, security checks and traceable releases.
Information security, audits and evidence
Organise responsibilities, risks and evidence in an operable information security management system.
Vulnerabilities and updates
Prioritise findings and plan updates to suit your operating systems and plants.