Cyber Resilience Act (CRA)
CRA compliance from product assessment to implementation
We help you implement the Cyber Resilience Act requirements for your software and hardware products. With your team, we assess gaps, improve product security, prepare technical documentation and support the applicable conformity assessment process.
Who this service is for
Manufacturers, importers and distributors serving the EU market
- You place hardware with digital elements on the EU market that connects directly or indirectly to a device or network.
- You supply standalone software or separately marketed components in the EU as part of a commercial activity. Their intended or foreseeable use involves a connection.
- You sell a covered product under your own name or brand, including products developed or manufactured for you.
- You import or distribute covered products in the EU and need to meet the duties attached to that role.
- We assess scope and exceptions for each product. Non-commercial open-source software and products covered by specific sector legislation need separate consideration.
Our free check gives a first answer for one product, with your role, its product class and first steps. Your answers stay on the page.
Take the free CRA assessmentWhat the work achieves
Product compliance from development through ongoing support
-
Product security requirements implemented
We help close the agreed CRA gaps and put proportionate security measures into product design, development and testing.
-
Vulnerability and update management in place
Your team has a workable process to assess vulnerabilities, arrange fixes, deliver security updates and meet applicable reporting duties.
-
Prepared for conformity assessment
Technical documentation, risk assessments and test evidence support the conformity assessment route for your product and preparation for the EU declaration and CE marking.
-
Compliance maintained as the product changes
Your team can review security and documentation as releases, components or risks change. Ongoing specialist advice can be agreed for the product’s support period.
What we cover
CRA assessment, implementation and conformity preparation
Product scope and compliance gaps
We determine applicable requirements, your role and the conformity assessment route. We assess existing practices and identify the gaps to address.
Product security risk assessment
We assess threats, intended use and third-party components, then recommend security measures proportionate to the product’s risks.
Secure development and testing
With your team, we incorporate security requirements, design reviews and testing into development and release processes, and help address identified weaknesses.
Vulnerability handling and reporting
We establish vulnerability intake, assessment and remediation processes. We help prepare the manufacturer’s required reports on actively exploited vulnerabilities and severe incidents affecting product security.
Software components and security updates
We help establish a software bill of materials (SBOM), component risk reviews and security update processes for the required support period.
Technical documentation and conformity assessment
We prepare the technical file, gather test evidence and support the applicable internal or independent conformity assessment process. We help prepare the EU declaration and CE marking requirements.
How it works
From CRA gaps to product compliance
-
01
Assess products and existing practices
We identify applicable requirements, product risks and compliance gaps, including the conformity assessment route.
-
02
Agree the implementation plan
We prioritise security changes, documentation and testing, then agree responsibilities and milestones with your team.
-
03
Implement security and lifecycle processes
We help your team implement product security measures, secure development, SBOM, vulnerability handling and update processes.
- 04
Prepare conformity assessment and ongoing reviews
We review documentation and test evidence for the applicable conformity assessment. We agree how your team will maintain compliance and what ongoing support is needed.
What we need from your team
- A list of your products, with how each one is sold and supported.
- A product owner or lead developer for each product we review.
- Your existing design documents, test results and release process.
- Someone who will own flaw reports once the procedure is live.
CRA Compliance
Your products decide the size of the project
The number and type of products, their software parts and your existing design documents and test results set the project price. Your proposal names each product in the work.
We agree the work and price with you in writing before we start.
Common questions
Common questions
Related services
Related regulations and standards
Free 30-minute call
Plan the work to meet CRA requirements
In a free 30-minute call, we discuss your products, existing security work and the support needed to prepare for CRA compliance.
