About this document

Version 1.1, 7 November 2026 (1.1: EU declaration of conformity added).

This page contains the information on product security that the EU Cyber Resilience Act (Regulation (EU) 2024/2847, Annex II) requires to accompany the product. It applies to all libraries of the DDAS Machine Insight Suite and to the Application Template.

Manufacturer and contact

Delaware Digital Application Solutions LLC (DDAS), 8 The Green #21635, Dover, Delaware 19901, USA

• Email: [email protected]

• Helpdesk: https://www.ddas.digital/helpdesk

• Website: https://www.ddas.digital/

Reporting vulnerabilities

Report a suspected vulnerability to [email protected]. Our coordinated vulnerability disclosure policy, our security advisories and a machine-readable advisory feed (CSAF) are published at https://security.ddas.digital/.

Product identification

The version of each installed library is shown in the CODESYS Library Manager; the version of the package in the CODESYS Installer. For the OEM edition, the SHA-256 checksum of the package file is delivered with the package (.sha256) together with a signature of DDAS (.sha256.jws); the public key is published at https://keys.ddas.digital/. From version 3.5.3.0 the checksum is also listed in the release notes.

Intended purpose and security environment

The libraries record production states, runtimes, piece counts and performance figures (OEE), calculate schedules and batch end times and provide time data in a CODESYS machine program. They run inside the CODESYS runtime of the controller and have no network interface of their own; they are reached only through the engineering access of CODESYS and through the variables that the machine program makes available.

The libraries are not designed for safety functions and must not be used for them. They rely on the security features of the controller and of CODESYS, which the machine builder and the operator provide:

• operate the controller in a protected, segmented network that is not directly reachable from the internet;

• use the CODESYS user management and encrypted communication for the engineering access;

• make library variables available to other systems (for example through the symbol configuration or OPC UA) only as far as necessary, and preferably read-only;

• keep the CODESYS development system and the runtime up to date.

Known risks in use

The following circumstances can lead to significant cybersecurity risks or wrong results:

• the controller is connected to an untrusted network, or library inputs and parameters can be written from outside the machine program;

• the controller clock is wrong or manipulated: time stamps, shift assignment and all time-based figures are then wrong;

• the error outputs of the function blocks are not evaluated in the machine program;

• the license is missing or expired: after the demo period all function blocks of a library stop and report an error; production figures are then no longer recorded. The machine program must not depend on these values for controlling the machine.

Security support period

The security support period is five years from the release of the version you purchased. During this period DDAS handles vulnerabilities and provides security updates. Security fixes are delivered in the latest compatible version of the product line; if you use an older version, you receive this version free of charge, even if it contains new functions. Installing it does not extend the support period of the version you purchased. Each new version with new functions (for example 3.5.3.0) gets its own end date of five years after its release, published on this page and in the release notes. Security updates are free of charge for all editions, independent of a maintenance license. Security updates remain available for at least ten years after their release.

Secure use, updates and decommissioning

• Commissioning and operation: set up the environment described under “Intended purpose and security environment”. Evaluate the error outputs of all function blocks. Keep a backup of the controller application and, if you use them, of retained and persistent data so that the machine can be restarted after a failure. The OPC UA server of the CODESYS runtime listens on all network adapters by default; restrict it to the networks that need it. We recommend CODESYS runtime 3.5.22.40 or later.

• Retained and persistent data: if you declare production data as RETAIN or PERSISTENT, a controller whose retained data are missing or no longer match after a change or a power failure may not load the application at all, including the machine program in the same application (CODESYS setting “Behaviour on retain mismatch”). After changes to such variables: clean, rebuild, if needed reset origin, download and create a new boot application instead of only replacing the boot application. Shut the runtime down properly; use a UPS or a retain backup.

• Changes: changing parameters such as shift plans, targets or the controller time changes the recorded figures. Read the release notes before using a new library version and test the machine program with it.

• Installing updates: updates are never installed automatically, so there is no automatic update to switch off. OEM edition: DDAS provides the new package through a personal download link. Before installing, compare the SHA-256 checksum of the package with the .sha256 file and check the signature .sha256.jws against the DDAS key at https://keys.ddas.digital/. The package is not signed with a code-signing certificate, so the CODESYS Installer reports it as unsigned; allow unsigned packages only after this check. Then install it with the CODESYS Installer, update the library references in the project, rebuild and download the application. SL edition: install the update from the CODESYS Store with the CODESYS Installer.

• Decommissioning: remove the library references from the project and uninstall the package. Production data is held in the controller. In the Application Template it is held in normal variables and is lost with every restart of the application; if you have declared it as RETAIN or PERSISTENT, reset the retained and persistent data (reset origin) or delete the boot application to remove it. The libraries do not store personal data.

Information for machine builders who integrate the libraries

If you integrate the libraries into your own product, you are the manufacturer of that product under the Cyber Resilience Act. For your technical documentation and your risk assessment you can use:

• the Software Bill of Materials (SBOM, CycloneDX and SPDX) of each released version, available on request through the DDAS helpdesk;

• the DDAS security advisories and the CSAF feed at https://security.ddas.digital/, to monitor vulnerabilities in the libraries;

• the EU declaration of conformity of the DDAS product (see EU declaration of conformity below);

• this page, for the assumptions on the environment and the known risks.

EU declaration of conformity

The full EU declarations of conformity of all DDAS products are published at https://conformity.ddas.digital/. Simplified EU declarations of conformity (Annex VI of Regulation (EU) 2024/2847) for version 3.5.2.0:

OEM edition (DDAS Machine Insight Suite Library Bundle): Hereby, Delaware Digital Application Solutions LLC declares that the product with digital elements type DDAS Machine Insight Suite Library Bundle CODESYS package (software package with libraries and application template) is in compliance with Regulation (EU) 2024/2847 (1). The full text of the EU declaration of conformity is available at the following internet address: https://conformity.ddas.digital/mis-oem/3.5.2.0/

SL edition (DDAS Machine Insight Suite SL): Hereby, Delaware Digital Application Solutions LLC declares that the product with digital elements type DDAS Machine Insight Suite SL CODESYS package (software package with libraries and application template) is in compliance with Regulation (EU) 2024/2847 (1). The full text of the EU declaration of conformity is available at the following internet address: https://conformity.ddas.digital/mis-sl/3.5.2.0/

(1) OJ L, 2024/2847, 20.11.2024, ELI: http://data.europa.eu/eli/reg/2024/2847/oj.