https://khanikar.com/series/oem-eu-readiness/Recent content in OEM EU Readiness on Rajesh KhanikarHugoen-gbhttps://khanikar.com/posts/identity-and-access-management/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/identity-and-access-management/Manufacturer engineers receive named identities in the asset owner's IAM with time-bound credentials. No shared accounts, no federation at the OT boundaryhttps://khanikar.com/posts/vulnerability-disclosure-programme/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/vulnerability-disclosure-programme/The CRA requires a public coordinated vulnerability disclosure programme. A customer email list is not one. The minimum-viable PSIRT, in 4-6 weekshttps://khanikar.com/posts/logging-and-soc-interoperability/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/logging-and-soc-interoperability/The asset owner's SIEM is the system of record. Devices emit standard-format logs with documented taxonomy and tamper-evident audit logshttps://khanikar.com/posts/patch-delivery-contract/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/patch-delivery-contract/Patches arrive as signed artefacts to the asset owner's repo with documentation and rollback. The owner schedules deployment. No auto-update, no silent installshttps://khanikar.com/posts/remote-access-but-not-the-kind-you-remember/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/remote-access-but-not-the-kind-you-remember/Persistent VPN tunnels are a 2015 architecture. What replaces them in EU-financed projects — unidirectional telemetry out, brokered just-in-time access inhttps://khanikar.com/posts/remove-the-cellular-modem/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/remove-the-cellular-modem/Cellular modems, Bluetooth, hidden USB ports — disabling them in firmware is not adequate. The hardware must be physically absenthttps://khanikar.com/posts/sanctions-and-provenance/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/sanctions-and-provenance/Sanctions and provenance disclosure for non-EU OEMs — what the lender's compliance pack contains, why a failed check has no negotiating roomhttps://khanikar.com/posts/the-communication-network/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/the-communication-network/The plant network — its segmentation, addressing, redundancy and firewall rules — belongs to the operator, not the manufacturer. What to specify, what not tohttps://khanikar.com/posts/cryptographic-baseline/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/cryptographic-baseline/TLS 1.3, no SHA-1, AEAD ciphers, asset-owner PKI, hardware root of trust, secure boot, post-quantum agility — the European bid cryptographic baselinehttps://khanikar.com/posts/cross-border-data-flow/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/cross-border-data-flow/Where the OEM's analytics telemetry actually terminates — GDPR Articles 44-49, Schrems II, and the data flow diagram the lender's DPO will readhttps://khanikar.com/posts/lifecycle-support-and-decommissioning/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/lifecycle-support-and-decommissioning/The service contract runs five years, the asset twenty-five — and the CRA's declared support period must reflect operational lifetime, not commercial cyclehttps://khanikar.com/posts/people-certifications-insurance/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/people-certifications-insurance/The vetted, certified engineers and the cyber insurance schedule the lender actually reads — the human and commercial layer alongside the technical architecturehttps://khanikar.com/posts/the-regulatory-stack/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/the-regulatory-stack/A 15-minute walk through five EU regulations and one framework that show up in every EU-financed renewable project — CRA, NIS2, GDPR, sustainable finance, Equator Principleshttps://khanikar.com/posts/the-substation-is-a-foreign-country/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/the-substation-is-a-foreign-country/Where the wind or solar plant ends and the substation begins is where the manufacturer's design authority ends absolutely — and whyhttps://khanikar.com/posts/the-l0-l1-system-integrator-role/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/the-l0-l1-system-integrator-role/What an OEM-as-system-integrator inherits under IEC 62443 — zone-and-conduit risk assessment, Target Security Levels, component capability mappinghttps://khanikar.com/posts/software-bill-of-materials/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/software-bill-of-materials/What an SBOM is under the CRA — why the lender's risk team reads it before the security team does, and what catches non-EU OEMs outhttps://khanikar.com/posts/when-the-money-comes-from-europe/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/when-the-money-comes-from-europe/A North African plant, an EU sponsor, a non-EU bidder, and the EU rulebook that travels down the financing chain — opening an 18-part series for suppliershttps://khanikar.com/posts/procurement-timeline-matrix/Fri, 15 May 2026 00:00:00 +0200https://khanikar.com/posts/procurement-timeline-matrix/The series closer — fifteen substantive topics mapped against eight procurement gates, with the dependencies that determine where each conversation belongs