Skip to content

EU Cyber Resilience Act

This page collects the information and instructions required by Annex II ("Information and instructions to the user") of Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), for the products with digital elements covered by this documentation: the AL300 (AssetLinker300) gateway and the Optimo IoT cloud platform.

1. Manufacturer identification

  • Legal name: Optimo IoT s.r.l.
  • Registered office: Via Francesco Restelli, 3 – 20124 Milano (MI), Italy — P.IVA 03834900130
  • Operational office: Via Sant'Anna, 16 – 23875 Osnago (LC), Italy
  • Email: info@optimoiot.it
  • Phone: +39 039 596 9780
  • Website: optimoiot.it

2. Reporting a security vulnerability

Cybersecurity vulnerabilities affecting the AL300 gateway or the Optimo IoT cloud platform can be reported to the manufacturer's dedicated point of contact:

See the Coordinated Vulnerability Disclosure Policy for what to include in a report, expected response times, and the disclosure timeline.

3. Product identification

  • Gateway: AL300 (AssetLinker300). Model, hardware revision and serial number are printed on the label affixed to the device enclosure and on the label included in the product packaging.
  • Firmware version: shown in the local/cloud web interface user menu, at the bottom of the panel described in Authentication → User information and version.
  • Cloud platform: Optimo IoT Cloud, reachable at cloud.optimoiot.it; being a continuously-updated SaaS service, it does not have a fixed version number, but the current version is shown in the user menu of the web interface, at the bottom of the panel described in Authentication → User information and version.

4. Intended purpose and security properties

The AL300 gateway is an industrial IoT device intended for installation inside electrical cabinets or other closed operating environments (see Safety instructions). It acquires data from field devices over industrial protocols (Modbus RTU/TCP, Siemens S7, LoRaWAN, OPC-UA, etc.) and forwards it to the Optimo IoT cloud platform, or exposes it locally, for monitoring, alarming and analysis.

Security-relevant functionalities provided by the platform include:

  • unique per-device credentials for the local web interface, generated at manufacturing time and printed on the device/package labels (see Quick start), with a recommendation to change them on first login
  • role and asset-based access control, so a user only sees the assets and variables associated with them (see Resources → Users)
  • optional multi-factor authentication (MFA) for cloud accounts (see Authentication → MFA)
  • outbound-only connectivity to the cloud platform: the gateway does not need to be reachable from the internet (see Firewall)
  • an optional encrypted remote-access VPN for reaching field devices, in place of exposing them directly on the network (see Remote access VPN)
  • signed firmware update packages, installable over-the-air or locally (see Firmware upgrade and OTA update)

5. Known or foreseeable circumstances leading to cybersecurity risks

The following circumstances, if present during use of the AL300 gateway or the cloud platform, are known to increase cybersecurity risk:

  • leaving the local web interface credentials at their factory-assigned values instead of changing them at first login
  • installing the gateway outside a closed electrical cabinet or otherwise granting physical access to unauthorized personnel (see Safety instructions)
  • exposing the gateway's local web interface or connected field devices directly to the public internet (e.g. via port forwarding) instead of using the remote access VPN
  • opening firewall ports beyond those documented in Firewall
  • running firmware versions for which security updates are no longer provided (see §8)
  • disabling multi-factor authentication on accounts with administrative privileges

6. Software Bill of Materials (SBOM)

Optimo IoT maintains an internal software bill of materials covering the top-level components and dependencies of the AL300 firmware and the Optimo IoT cloud platform, as required by Article 13(24) of the Cyber Resilience Act.

The SBOM is not published publicly. It is made available to market surveillance authorities upon reasoned request.

7. EU Declaration of Conformity

The EU Declaration of Conformity for the AL300 is available here.

8. Security update support period

Optimo IoT provides security updates for the AL300 gateway free of charge to all customers for 5 years from the date of purchase from Optimo IoT.

Feature updates (new functionality, non-security improvements) are provided to customers with an active Optimo IoT Cloud subscription.

Firmware updates, including security updates, can be installed through any of the methods described in Firmware upgrade: over-the-air (OTA) from the cloud platform, via the local web interface, or via USB stick.

9. Instructions for secure use

Secure commissioning

  1. Install the gateway as described in Installation, respecting the safety instructions.
  2. Access the local web interface using the unique credentials printed on the device/package labels, as described in Quick start.
  3. Change the local web interface credentials at first login.
  4. Enable multi-factor authentication on accounts with administrative privileges.
  5. Prefer the remote access VPN over exposing field devices or the local web interface directly on a routable network.
  6. Review and restrict firewall rules to only the ports required for the deployment.

Security update installation

Apply firmware updates as described in Firmware upgrade and OTA update. OTA updates via the cloud platform are the recommended method, as they do not require physical access to the gateway.

Data security implications of configuration changes

Changes to network settings, data source configuration or user permissions can affect which data is collected, where it is sent, and who can access it. Configuration is synchronized between the gateway and the cloud platform (see Resources → AL300 Gateway configuration); review changes made by any collaborator with configuration access, and restrict that access using the role/asset model described in §4.

Secure decommissioning

Before removing the gateway from service, disposing of it, or transferring it to a third party:

  1. Perform a factory reset to irreversibly wipe all configuration, credentials and locally-stored acquired data from the device.
  2. Remove any inserted SIM card.
  3. Dispose of the device following the Decommissioning and disposal instructions, including separate collection under WEEE regulations.