Starting December 2027, the Cyber Resilience Act (CRA) takes full effect across Europe, raising the bar for industrial cybersecurity. CRA introduces obligations for OEMs to secure, monitor and maintain connected products across the lifecycle, depending on product scope.

What many don't realize: the operating system underneath is part of that responsibility. CRA compliance depends on secure foundations, with the operating system working alongside the hardened security built into the underlying processing platform. As connected systems scale across factories and other industrial environments, choosing secure, compliant platforms helps reduce complexity and total cost of ownership (TCO).

To solve this, Bosch Rexroth worked with NXP to develop a pre-hardened industrial automation platform. By pairing Bosch's IEC 62443-4-2 certified ctrlX OS with NXP's i.MX 9 series of industrial applications processors, the companies built a complete control system from secure silicon and OS runtime to third-party applications.

The Challenge: The Cost of Building and Maintaining Industrial Linux

Industrial automation runs on Linux. Programmable logic controllers (PLCs), human-machine interfaces (HMIs), gateways and edge servers in every factory rely on a Linux runtime, and in most cases that means a custom distribution. But with the impending CRA rollout, balancing cost, scalability and compliance is becoming a challenge. Roadblocks include:

• Ongoing maintenance burden: Custom distributions need dedicated teams for kernel patches, package updates and long-term support
• High certification overhead: Achieving IEC 62443-4-2 compliance from scratch can take years and substantial engineering investment
• Exposure: Connected industrial products sold in the EU after December 2027 must demonstrate continuous security through their full lifecycle
• Fragmented ecosystems: Each vendor's Linux variant creates integration friction for customers running mixed fleets

Bosch Rexroth set out to help the industry move forward safely, without having to rebuild infrastructure from scratch. Through its ctrlX OS Ecosystem, the company aimed to deliver an open-architecture, secure-by-design industrial-grade operating system that customers could deploy in any use case.

“With the CRA raising the bar for industrial cybersecurity, our partnership delivers a pre-hardened platform that simplifies compliance and accelerates time to market. By integrating ctrlX OS with NXP's EdgeLock® Secure Enclave, we enable engineers to focus on innovation while we manage the complexity of a secure, certified OS.”

Praveen Tamang, Global Head of Automation Software
Bosch Rexroth

The platform needed to integrate with secure silicon and a hardware root of trust. And it had to deploy on partner hardware, without OS-level engineering work from the end customer. To bring this vision to life, Bosch Rexroth needed a technology partner that could provide:

• An industrial applications processor family that scales across performance tiers with a long lifecycle, strong roadmap and certified security
• A hardware secure enclave to anchor identity, secure boot and full-disk encryption
• TPM 2.0-compatible APIs aligned with the Ubuntu Core security mode
• Out-of-the-box reference designs for remote I/O, fieldbus and analog sensing
• Container support for Codesys and third-party applications on Arm®
• Engineering co-development to validate ctrlX OS across the processor series

Turning these requirements into a deployable industrial platform required tight integration across hardware, software and applications.

Solution: A Certified Industrial Platform, Co-Developed From Silicon to App

Together, Bosch Rexroth and NXP co-engineered a tightly integrated industrial platform — connecting secure silicon, a hardened OS runtime and application deployment into a single, production-ready system.

The i.MX 9 series integrates NXP's EdgeLock® Secure Enclave, anchoring secure boot, key storage and runtime integrity in certified hardware. The family also scales easily across performance tiers and into different application segments, so Bosch can use the same architecture in multiple products or SKUs.

On top of this, Bosch Rexroth's IEC 62443-4-2 certified ctrlX OS delivers a hardened industrial Linux runtime, giving customers a secure foundation aligned with industry standards and CRA requirements, without having to build and maintain their own distribution.

This foundation enables open application deployment, with support for containerized Codesys and third-party software on Arm eliminating the need for bespoke porting.

To extend the platform for real-time control, the i.MX 9 processor is paired with the i.MX RT1180 crossover MCU, enabling deterministic workloads alongside applications processing. NXP further complements the platform with out-of-the-box remote I/O reference designs, fieldbus connectivity and configurable analog sensing via its NAFE analog front end.

Together, these elements form a complete, production-ready industrial control system validated from silicon to application layer.

NXP Technology Inside

Hardware Security Foundation

i.MX 9 Applications Processors

Industrial-grade Arm processors with integrated EdgeLock Secure Enclave, enabling hardware-rooted security and long-term lifecycle support

EdgeLock Secure Enclave

On-die security subsystem providing certified key storage, secure boot and a hardware root of trust, helping protect sensitive data and ensure trusted device operation throughout the lifecycle

Real-Time + I/O Expansion

i.MX RT1180 Crossover MCU

Combines real-time microcontroller determinism with applications-class performance for industrial control workloads, including analog network and IP

NAFE (NXP Analog Front End)

A configurable 8-channel, 24-bit analog front end that enables programmable universal inputs for precision sensor data acquisition

Results: A Pre-Hardened Path to Certified Industrial Control

The result is a pre-hardened industrial control platform that combines secure real-time control, networking and remote I/O.

Industrial designers gain:

• Lower total cost of ownership: Bosch Rexroth's ctrlX AUTOMATION cuts component and engineering costs by 30% to 50% versus traditional automation stacks
• Security built in: IEC 62443-4-2 certified OS provides a strong security baseline and supports customers in addressing CRA requirements
• Faster time to market: Out-of-the-box remote I/O, fieldbus and sensor profiles let OEMs spin up a complete system proof of concept with minimal integration effort
• Platform scalability: One i.MX 9 architecture spans performance tiers and applications, from HMIs and building automation to industrial controllers and smart energy systems
• Hardware-rooted security: TPM 2.0 API support and EdgeLock integration plug NXP security directly into customers' legacy factory security stacks
• Open application ecosystem: Codesys containers and third-party app deployment on i.MX 93 and i.MX 943 gives end customers the open architecture they expect

“By integrating ctrlX OS directly onto i.MX 9 with EdgeLock Secure Enclave at the root, we give customers a validated security foundation for industrial systems and time back to focus on what differentiates them.”

Mattias Lange, Vice President, Industrial Systems Engineering and Marketing
NXP Semiconductors

What's Next

With CRA rolling out across Europe, this collaboration is the start of a new chapter for industrial automation. As CRA compliance is based on product-specific, risk-based implementation, solutions like this provide a strong foundation to support manufacturers in meeting applicable requirements. Future solutions will extend ctrlX OS to the i.MX 95, i.MX 952 and i.MX 94 platforms, making IEC 62443-4-2 certified security more accessible and reliable to designers in all industries. Together, we're enabling a new generation of secure, software-defined industrial automation.

About Bosch Rexroth

As one of the world's leading suppliers of drive and control technologies, Bosch Rexroth ensures efficient, powerful and safe movement in machines and systems of any size. The company bundles global application experience in the market segments of Mobile and Industrial Applications as well as Factory Automation. With its intelligent components, customized system solutions, engineering and services, Bosch Rexroth is creating the necessary environment for fully connected applications. Bosch Rexroth offers its customers: hydraulics, electric drive and control technology, gear technology and linear motion and assembly technology, including software and interfaces to the Internet of Things. With locations in over 80 countries, around 31,900 associates generated sales revenue of 6.5 billion euros in 2025.

Learn more about Bosch Rexroth