How Jungheinrich Efficiently Completed EN 18031 Self-Assessment Using Z-CMS

Jungheinrich's EN 18031 Compliance Journey

To deliver high-quality products, Jungheinrich prioritizes cybersecurity from the design phase. Consequently, our products were already aligned with EN 18031 requirements. The primary challenge lay not in meeting these requirements but in compiling the necessary technical documentation and conducting assessments to demonstrate our compliance.

As a large organization, we have numerous products developed by various teams, complicating our compliance efforts. This situation required collaboration among stakeholders from different functions to manage multiple compliance projects simultaneously.

Initially, the engineering team took charge of the compliance projects and began manual documentation in Excel, with support from skilled consultants. However, after several months of this labor-intensive approach, it became clear that manual documentation was inefficient and could jeopardize our internal timelines. To keep the project on track, we sought a more automated solution and chose to adopt Z-CMS for creating technical documentation and test plans.

What Jungheinrich Loved About Z-CMS

• Streamlined compliance activities: The clear guidance and navigation enabled all stakeholders to understand the scope of compliance activities.

• Dashboard for compliance tracking: A central dashboard provided immediate visibility into compliance status for each product.

• Task assignment for team collaboration: An easy way to divide and delegate tasks among team members.

Before and After: How Z-CMS Provided More Efficient Approach

Enhanced Visibility over Compliance Activities

Pain Point

The EN 18031 self-assessment requires three main activities: product documentation, vulnerability management, and assessments. Although we understood the broad expectations, the specific depth of each activity remained ambiguous.

Solution

Z-CMS breaks down the complex EN 18031 requirements into manageable "topics" and reorganizes them in a logical sequence. This structure is presented clearly on the Navigation page, allowing each topic's completion to be tracked and displayed. Within these topics, dedicated pages address product documentation and vulnerability management. For assessments, we can download test plans at any time, gaining upfront visibility into the necessary work.

Enhanced Control over Project Management

Pain Point

Managing multiple compliance projects across various subsidiaries and teams was challenging due to the lack of visibility into compliance status from manually compiled Excel documentation.

Solution

With Z-CMS, the Project Manager can simply refer to the dashboard to monitor the progress across our product portfolio. The dashboard provides an overall completion percentage, a summary of Decision Tree counts, and a breakdown of results per topic. Any failed Decision Tree results are highlighted, enabling the Project Manager to allocate resources effectively to resolve non-compliance issues.

Enhanced Team Collaboration

Pain Point

Without Z-CMS, all team members initially had to read and comprehend the EN 18031 standards independently before engaging in activities. Even after reading, the ambiguity of the standards led to lengthy discussions about their interpretation.

Additionally, working in Excel made it difficult to determine individual task assignments, progress, and areas where team members needed assistance. Incomplete work often became obscured among hundreds of cells and worksheets.

Solution

Z-CMS effectively addresses these challenges by providing a question-and-answer format supplemented with rich guidance and clear references to EN 18031 standards. New team members can quickly get up to speed by following the structured questions and guidance. Each question is linked to specific references in the EN 18031 standards, allowing us to learn progressively without needing to read the entire standards upfront.

The task assignment feature significantly enhances team collaboration. For instance, when our software engineer is unsure how to answer a question related to hardware, they can easily assign it to a hardware engineer. This task is then aggregated into a task management page where all team members can view their assignments, ensuring that nothing will be left incomplete.

Automatic Test Plan Generation

Pain Point

The EN 18031 standards mandate various assessments, but they do not provide detailed guidance on how to create test plans or reports. The engineering team faced considerable challenges in devising viable test plans tailored to our products.

The sheer number of test items exceeded thousands, given we had over 400 Decision Trees per product. Each Decision Tree required both conceptual and functional assessments, making manual test plan creation an overwhelming task.

Solution

With just a click, Z-CMS automates the generation of comprehensive test plans, organizing all test items under the relevant requirements. This immediate access allows our team to begin assessments without delay. Furthermore, the quality of the generated test plans is high, offering clear instructions for each assessment and supplementary notes on their execution. This capability enabled us to quickly establish in-house testing capabilities, upskilling our team to conduct cybersecurity tests independently. We believe this proficiency will prove invaluable as we move toward Cyber Resilience Act (CRA).

Conclusion

Through the implementation of Z-CMS, Jungheinrich successfully navigated the complexities of the EN 18031 self-assessment process. By enhancing visibility, control, and collaboration, Z-CMS proved to be an indispensable tool in meeting our compliance objectives efficiently. Moreover, the automated features and structured approach have significantly strengthened our in-house capabilities to tackle cybersecurity regulations. This enhancement positions us well as we prepare for the upcoming CRA, ensuring that we remain at the forefront of industry standards in cybersecurity and compliance.