Engineering Security from design to support
Balboa Water Group displays, controllers, gateways and software increasingly connect your machines to operators, service tools and the cloud. Together with Helios Technologies, we have established a product cybersecurity management system that builds protection into how we design, test, release and support every product.
Secure by design
Threat analysis and security requirements before features are built.
Standards-aligned
A lifecycle aligned to ISA/IEC 62443 and ISO/SAE 21434.
Supported in the field
SBOMs, vulnerability monitoring and security updates.
Transparent response
A dedicated Helios PSIRT and coordinated disclosure.
Our commitment
Protecting your machines, your data and your customers' trust
Mobile and industrial equipment now depends on connected electronics: CAN networks, telematics, operator displays and remote service. That connectivity brings value, and it also brings risk. Our goal is to make cybersecurity a repeatable engineering discipline, backed by evidence you can rely on, rather than a checklist completed at the end of a project.
Across the Helios family
Balboa Water Group follows the Helios Secure Development Lifecycle, a single company-wide process shared by Helios operating companies developing electronic hardware, embedded software and connected devices.
Proof, not promises
Security work produces release-specific records: threat models, security requirements, test results, software bills of materials and customer guidance, collected in a product security file for each version.
Trained engineering teams
Our product engineers are trained in threat analysis, security requirements, secure architecture, verification and evidence capture, so cybersecurity decisions are made by the people who build the product.
The Helios Secure Development Lifecycle
One lifecycle, product by product
The Helios Secure Development Lifecycle (SDL) is a unified, Helios-wide interpretation of ISA/IEC 62443-4-1, the internationally recognized standard for secure product development. It defines how security is planned, specified, designed, built, verified, maintained and documented for every Helios electronics program, and it is the foundation for product-level requirements under ISA/IEC 62443-4-2.
Discover
Define the product boundary, interfaces, threats and accountable owner.
Design
Turn risk into testable security requirements and a secure architecture.
Verify
Test access control, updates, recovery and residual risk before release.
Support
Monitor, remediate and confirm that fixes work in the field.
Eight practice areas, based on ISA/IEC 62443-4-1
Select a practice area to read more.
SMSecurity management
Governance, defined roles and responsibilities, secure development environments, protection of signing keys and oversight of third-party components.
SRSecurity requirements
Each product's security context and threat analysis and risk assessment (TARA) drive documented, reviewed security requirements.
SDSecure by design
Secure-by-default architecture, minimized attack surface, defense in depth and formal security design reviews.
SISecure implementation
Secure coding standards, dependency hygiene and security-focused implementation reviews.
SVVVerification & validation
Security requirements testing, threat mitigation testing, vulnerability scanning and penetration testing, with tester independence.
DMDefect management
A structured process to receive, triage, score, remediate and disclose security issues throughout the product's life.
SUMSecurity update management
Qualification, documentation and secure delivery of security updates, including updates to third-party and operating-system components.
SGCustomer security guidelines
Guidance for integrators and operators on hardening, secure operation, account management and secure disposal.
Governance you can count on. Product cybersecurity risk is reviewed regularly by Helios leadership, with named owners and target dates for every action, and products are prioritized by exposure so that effort goes where it reduces the most risk.
Standards and regulations
Aligned to the frameworks your markets require
One engineering workflow lets us apply the requirements that matter for each product and market. We select the applicable requirements, design controls into the product, test them, and retain the evidence for each release.
ISA/IEC 62443-4-1 & 4-2
Industrial cybersecurity
What it covers
Secure product development lifecycle (4-1) and technical security requirements for components such as embedded devices and network devices (4-2).
Our approach
Our program is aligned to ISA/IEC 62443 secure product development lifecycle principles through the Helios SDL. Product security requirements are mapped to ISA/IEC 62443-4-2, with target security levels set per product.
ISO/SAE 21434
Road vehicle cybersecurity engineering
What it covers
Cybersecurity risk management across the concept, development, production, operation and decommissioning of vehicle electrical and electronic systems.
Our approach
We are implementing cybersecurity engineering processes aligned to ISO/SAE 21434 concepts, including TARA, for applicable connected and mobility products.
UN R155 & R156
Vehicle cybersecurity and software updates
What it covers
Cybersecurity management system and software update management system requirements for vehicle type approval.
Our approach
For applicable vehicle programs, we support our OEM customers' cybersecurity and software update management obligations with supplier evidence and secure update practices.
EU RED Article 3.3
Radio Equipment Directive (d), (e), (f)
What it covers
Cybersecurity essential requirements for internet-connected radio equipment: network protection, protection of personal data and privacy, and protection from fraud, supported by the EN 18031 harmonized standards.
Our approach
For radio-enabled products placed on the EU market, our secure development practices address the RED Article 3.3 cybersecurity requirements, using the EN 18031 series as the technical reference. Applicability and conformity are determined product by product.
EU Cyber Resilience Act
Regulation (EU) 2024/2847
What it covers
Cybersecurity requirements for products with digital elements, including secure design, vulnerability handling, security updates for a defined support period and reporting of actively exploited vulnerabilities.
Our approach
We are actively aligning our cybersecurity program and supporting product documentation to the CRA's requirements. Compliance status is evaluated at the product level and depends on market applicability, product classification and supporting evidence.
A note on certification. Our program is aligned to the standards above. We do not currently claim ISA/IEC 62443 or ISO/SAE 21434 certification, and product-specific compliance status may vary by platform and release. Contact us for the status of a specific product.
Security by design
A common security architecture for connected products
Rather than solving security product by product, we are building a reusable set of security capabilities into our connected platforms, so every new product starts from a proven foundation.
Select a capability to read more.
Hardware root of trust
Hardware-protected key storage to safeguard device secrets and cryptographic keys.
Secure boot
Cryptographically verified start-up so only authentic software runs on the device.
Signed updates
Authenticated firmware and software updates with integrity checks and anti-rollback protection.
Device identity
Unique device credentials and encrypted, mutually authenticated communications for connected services.
Debug and service lock
Protection of debug and service interfaces against unauthorized re-flashing and tampering.
Isolation
Memory and function isolation to limit the impact of a fault or attack.
Security event logging
Recording of security-relevant events to support diagnosis and incident response.
Safe recovery
Defined recovery paths that return a device to a known-good state.
Product-specific capabilities. These capabilities are designed into our newer connected platforms. Availability varies by product, hardware generation and software release; we will confirm the capabilities of the specific product you use.
SBOMs, vulnerability management and response
Supporting your products throughout their service life
Security does not end at shipment. We track the software inside our products, watch for new vulnerabilities and respond through a defined, coordinated process.
Software bills of materials
SBOM generation and software component tracking are part of our development process for modern software products, recording each component's name, version, supplier, license and hash. We use the CycloneDX format, with vulnerability exploitability (VEX) status to show whether a known vulnerability affects the product.
Vulnerability monitoring
Known vulnerabilities in our software and third-party components are reviewed, assessed for real-world impact and prioritized by severity and exposure, with exceptions requiring Product Security approval.
Security updates
Security fixes are qualified, documented and delivered through secure update mechanisms, together with guidance on how to apply them.
The Helios Product Security Incident Response Team (PSIRT)
The Helios PSIRT is the single point of contact for reporting a potential security vulnerability in any Helios or Balboa Water Group commercial product, including hardware, firmware and embedded software, and the configuration, programming and diagnostic software and mobile apps we supply. Its practices are informed by ISO/IEC 29147, ISO/IEC 30111 and the ISA/IEC 62443 series.
- 1
Receipt
The report is logged and acknowledged.
- 2
Evaluation
The PSIRT works with the responsible product team to reproduce the issue and determine the affected products, versions and severity.
- 3
Response
Where action is appropriate, we develop and validate an update, mitigation or configuration guidance.
- 4
Coordinated disclosure
We notify affected customers and, where appropriate, coordinate with CERTs, CVE Numbering Authorities and regulators.
Our vulnerability response procedures are designed to support the CRA's reporting obligations for actively exploited vulnerabilities and severe incidents.
Report a potential vulnerability
Email the Helios PSIRT with:
- The product name, model or part number
- The software or firmware version
- A description and steps to reproduce
- The potential impact
Please send one report per issue and do not include personal data or credentials.
psirt@heliostechnologies.comIf a situation presents an immediate risk to people, property or the environment, contact local emergency services and the equipment operator first. This channel is not monitored around the clock.
OEM partnership
Securing the finished machine, together
Your machine's security depends on how every component works together. We work with OEM engineering teams to make the integrated system secure, with clear ownership of each responsibility.
Joint threat review
Review how our products connect within your machine and where the risks lie.
Clear responsibility boundaries
Agree which security controls the component provides and which the machine or operator environment provides.
Secure integration guidance
Hardening, secure operation, account management and secure disposal guidance for our products.
Shared verification
Coordinate security testing of the integrated system where your program requires it.
Customer-ready evidence
Security documentation, SBOMs and questionnaire responses to support your own compliance and customer requirements.
Installed-base support
Compensating-control recommendations for older products that predate current security capabilities.
Frequently asked questions
Common customer questions
Short answers to the questions we hear most. Select a question to see the answer. For product-specific detail, contact us.
Are you IEC 62443 certified?
We maintain a cybersecurity program aligned to ISA/IEC 62443 secure product development lifecycle principles. Current activities include secure development processes, threat modeling, product security requirements management, vulnerability management, software maintenance and security testing. Product-specific compliance status may vary by platform and release.
Are you ISO/SAE 21434 certified?
We are implementing cybersecurity engineering processes aligned to ISO/SAE 21434 concepts for applicable connected and mobility products. We do not currently claim ISO/SAE 21434 certification.
Are your products compliant with the EU Cyber Resilience Act?
We are actively aligning our cybersecurity program and supporting product documentation to the requirements of the EU Cyber Resilience Act. Compliance status is evaluated at the product level and depends on market applicability, product classification and supporting evidence.
Do you perform threat modeling?
Yes. New products undergo structured threat analysis and risk assessment (TARA) during development.
Can you provide an SBOM?
SBOM generation and software component tracking are part of our cybersecurity strategy for modern software products. Contact us to discuss SBOM availability for your product.
Do your products support secure updates?
Our newer platforms support authenticated updates with integrity verification. Capabilities vary by product and release.
How do I report a security vulnerability?
Email the Helios PSIRT at psirt@heliostechnologies.com. See the reporting guidance in the vulnerability management section above.
How do you address the Radio Equipment Directive requirements?
For radio-enabled products placed on the EU market, our secure development practices address the cybersecurity requirements of RED Article 3.3(d), (e) and (f), using the EN 18031 series as the technical reference. Applicability and conformity are determined product by product.
Contact us
Questions about the security of a Balboa Water Group product?
For product security questions, documentation requests or to report a potential vulnerability, contact the Helios Product Security team.
This page is provided for information only. It is not a warranty or a representation about the security of any specific product, and it does not change any contract, warranty or terms of sale. Last updated November 2026.
Balboa Water Group is a Helios Technologies company. Helios Technologies and the Helios logo are trademarks of Helios Technologies, Inc. ISA/IEC 62443, ISO/SAE 21434 and other standards named are the property of their respective owners.