CRA in Mechanical Engineering: How Companies Manage Risks, Select Secure Components and Protect OT Networks Despite the Lack of Guidelines

Mechanical engineering companies are faced with the dilemma of having to prepare without knowing exactly what to prepare for. The same applies to the suppliers of the components they need to implement CRA.
Advanced companies have already carried out a CRA risk assessment for all machine series and know which risks can occur, to what extent and with what effects, and how they can mitigate these risks.

However, to make their machines and systems safer, they need electronic products, e.g. PLCs, HMIs, switches or firewalls, which themselves must also comply with CRA. When selecting products, there is a risk that they will no longer be supplied in the future because they are not CRA-compliant. Re-designs are therefore critical at the present time, as they are usually complex and take some time. It can also happen with machines in the field that spare parts are no longer available due to a lack of CRA compliance.
So the crux of the matter is: how to start without knowing the exact goal?