Modern lifts are no longer purely mechanical installations. With the integration of software, electronics and remote monitoring, lift systems are increasingly connected to other digital environments. This creates opportunities for smarter maintenance and more efficient management, but also introduces new cybersecurity risks.
A vulnerability in a lift system could, for example, provide access to connected monitoring applications and underlying IT environments. At the same time, legislation and regulations, such as the NIS2 Directive and the Cyber Resilience Act, are placing increasingly stringent demands on cybersecurity.
For Liftinstituut, a specialist in the inspection and certification of lifts and other vertical transportation systems, these developments prompted an expansion of its existing services to include cybersecurity. In Sopra Steria, the organisation found a partner with the technical expertise to identify digital vulnerabilities and strengthen the cyber resilience of lift systems.
“Traditional safety inspections remain essential, but they do not provide sufficient insight into the cyber risks associated with modern lift systems,” says Tijmen Molema, Functional Safety and Cybersecurity Certification Expert at Liftinstituut. “To continue supporting our customers effectively in an increasingly digital environment, we have integrated cybersecurity into our existing inspection and service portfolio, linking cybersecurity with safety and compliance.”
Two areas of expertise, one integrated approach
The partnership between Liftinstituut and Sopra Steria brings together two complementary areas of expertise. Liftinstituut contributes in-depth knowledge of lift safety, inspections, certification and regulatory requirements. Sopra Steria adds specialist cybersecurity expertise, assessing systems from the perspective of a potential attacker.
Following a successful pilot, the two organisations developed a joint approach in which compliance and technical security testing reinforce one another. Rather than focusing solely on individual components, they examine the entire digital environment surrounding a lift system.
“We don't simply plug in a network cable to see what happens,” explains Wouter Doderer, Head of Cyber Offensive & Defensive Security at Sopra Steria. “We examine the entire technology stack, right down to the hardware level. We inspect circuit boards, analyse firmware and investigate whether components contain passwords or vulnerabilities, for example. We then examine applications, network traffic and connected monitoring environments.”
From compliance to cyber resilience
The partnership has enabled Liftinstituut to further develop its services. By combining cybersecurity testing with existing safety inspections, the organisations gain a more comprehensive understanding of the risks associated with connected lift systems. This shifts the focus from simply meeting safety and compliance requirements to actively strengthening cyber resilience.
Would you like to understand the cybersecurity risks within your operational technology (OT) environment and how to address them? Our cybersecurity experts can help you identify vulnerabilities and take practical steps towards a safer, more resilient organisation.