Winbond adds CRA integration kit for W77Q Secure Flash

Winbond has introduced a CRA Conformance and Integration Kit for its TrustME W77Q Secure Flash family, bringing together hardware security, software, integration guidance, testing resources, reference designs and security evidence to support manufacturers’ product-level Cyber Resilience Act work.

TrustME W77Q Secure Flash has achieved SESIP Level 2 certification. The component-level assessment provides security evidence for customers evaluating the memory and their finished products; it does not by itself establish CRA conformity of a finished product.

For platforms already using external NOR Flash, Winbond describes W77Q as a migration option where package, voltage, interface and system requirements align. Integration may require hardware and software changes, although the company says it can strengthen external memory security without a separate security component or complete platform redesign.

The kit includes mapping of relevant CRA Annex I security objectives to W77Q capabilities, hardware integration guidelines, a low-level security library and sample code. The software resources cover secure storage, authentication, updates, recovery and lifecycle management.

Other resources include positive and negative integration-test scenarios, reusable system-verification cases, risk-assessment templates, vulnerability-handling and supply-chain documentation, security characteristics and reusable security evidence. A conformity checklist and reference designs combine W77Q with selected MCU platforms. Selected open-source implementations, Linux reference drivers and remote secure-update components are also included.

Supported W77Q devices use the Leighton-Micali Signature scheme specified in NIST SP 800-208 to authenticate firmware and software updates. The kit builds on Winbond’s post-quantum cryptography work, with supported capabilities depending on the selected device and system architecture.

Protected storage, authenticated software updates, version enforcement, rollback protection and recovery are among the W77Q security functions. Target applications include industrial automation, Industrial IoT, networking, smart buildings and access control, HVAC, energy, EV charging and smart appliances.

“The Cyber Resilience Act makes cybersecurity a lifecycle responsibility. Our CRA Conformance and Integration Kit brings together Secure Flash, software, validation assets, and reusable security evidence to help customers integrate security functions and document their designs. W77Q’s SESIP certification provides independent assessment of the component, helping customers establish a stronger foundation for their own product-level compliance activities,” said Winbond.