Rockwell Automation on Oct. 13 introduced the CompactLogix 5390, a new controller in its Integrated Architecture family that the company says combines built-in cybersecurity, integrated safety and higher performance on one platform. The Milwaukee-based supplier is aiming the controller at machine builders and manufacturers that face tighter security and safety requirements, including the European Union’s Cyber Resilience Act.

According to the release, the controller’s security capabilities are aligned with IEC 62443-4-2, the part of the ISA/IEC 62443 series that sets technical security requirements for industrial automation and control system (IACS) components, and Rockwell describes the product as ready for the Cyber Resilience Act. The company said the CompactLogix 5390 has a footprint 43% smaller than previous CompactLogix 5380 controllers, which it said can reduce panel space and help standardize designs across machine families.

The controller supports local PointMax I/O, which Rockwell said allows more modular architectures. It is designed to work with the rest of the company’s Integrated Architecture portfolio, including PointMax I/O, Kinetix motion products, PowerFlex drives, Stratix networking and FactoryTalk Design Studio software, as well as visualization products. Rockwell said that integration simplifies engineering workflows, reduces commissioning risk and gives users a path from standalone machines to complex production systems.

“Manufacturers and machine builders are being asked to do more than deliver performance,” Siva Iyyamperumal, senior product manager at Rockwell Automation, said in the announcement. He said the controllers bring security, safety and performance together so customers can simplify machine design and prepare for regulation.

The release is light on hardware detail. It does not list memory capacity, motion axis counts, I/O limits, safety integrity or performance level ratings, pricing or a shipping date, and it does not define what “integrated safety” covers. It directs buyers to Rockwell’s product page or authorized distributors. The company names original equipment manufacturers (OEMs), systems integrators and end users as target customers, for applications ranging from complex machines to process skids and production systems.

The regulatory backdrop

The European Commission describes the Cyber Resilience Act (CRA) as a rulebook meant to make sure digital products are safe from cyber threats. It sets mandatory cybersecurity requirements for manufacturers; compliant products carry the CE marking, and national market surveillance authorities enforce the rules. The act entered into force on Dec. 10, 2024. Its reporting obligations have applied since Sept. 11, 2026, and its main obligations apply from Dec. 11, 2027, according to the Commission.

The International Society of Automation (ISA) describes the ISA/IEC 62443 series as a set of requirements and processes for securing IACS. The series addresses asset owners, automation product suppliers, integrators and service suppliers, and covers control system security across its full life span. Within it, part 4-1 deals with secure product development life-cycle requirements, part 4-2 with technical security requirements for IACS components, and part 3-3 with system security requirements and security levels. ISA says the IEC recognized the series as a horizontal standard in 2021.

Why it matters

Because the CRA ties cybersecurity requirements to the CE marking, product security becomes part of what manufacturers must show to sell into the EU market. Controllers sit at the center of most machines, so OEMs that ship to Europe have a direct interest in hardware whose security functions are mapped to a recognized component standard such as IEC 62443-4-2. Rockwell’s pitch is that putting security, safety and control in one smaller controller cuts both engineering effort and compliance work.

The wording deserves attention. The release says the controller’s security capabilities are “aligned with” IEC 62443-4-2; it does not say the product has been certified against the standard by an independent body. Integrators specifying the controller for regulated projects will need to get certification documents, safety ratings and technical data from Rockwell’s product documentation, since the announcement does not include them.

What to watch

  • Publication of full technical specifications, safety ratings and availability dates for the CompactLogix 5390, which the release does not provide.
  • Dec. 11, 2027, when the CRA’s main obligations apply, according to the European Commission. Reporting obligations already apply as of Sept. 11, 2026.
  • Whether Rockwell publishes third-party IEC 62443 certification for the controller, as distinct from the alignment claim in the launch release.

The caveats

The product claims, including the 43% footprint reduction and the readiness for the CRA, come from Rockwell’s announcement and have not been independently tested. The regulatory dates come from the European Commission, and the description of the 62443 series comes from ISA. Compliance with the CRA depends on the finished product and the manufacturer’s processes, not on any single component.