EU Cyber Resilience Act (CRA) – From CRA Gap Analysis to Conformity Assessment
We support manufacturers, importers, and distributors with CRA compliance across the entire product lifecycle: Security by Design, Security by Default, vulnerability management, incident reporting processes, and robust evidence management.
CRA in a Nutshell: How to Make Your Products Cyber-Secure
The CRA consolidates product obligations, vulnerability handling, supply chain transparency, and user information requirements into four central pillars. The CRA requires security measures across the entire product lifecycle – not just at initial release.
With the Cyber Resilience Act, the EU establishes a binding legal framework to ensure the security of products with digital elements throughout their entire lifecycle. Manufacturers, importers, and distributors are required to consider Security by Design from the development stage.
CRA Requirements at a Glance
Product requirements: Adequate cybersecurity level, Security-by-Design, Security-by-Default, protection of confidentiality, integrity, and availability
Vulnerability handling: Accept reports, regular testing, free security updates with user notification, public vulnerability disclosure
Third-party components & supply chain: Software Bill of Materials (SBOM), due diligence for third-party components, tracking potential vulnerabilities to suppliers
Minimum manufacturer information: Vulnerability contact point, product identification, intended use information, EU Declaration of Conformity
Reporting obligations active from September 11, 2026: 24h early warning, 72h notification, final report within 14 days/1 month
Full CRA compliance required by December 11, 2027
Reporting Obligations for Actively Exploited Vulnerabilities
CRA reporting is a regulatory timeline architecture. Manufacturers bear the burden of proof and assessment for when a reporting trigger occurs and when the deadline starts.
Early Warning
Immediate initial report to ENISA/national authority for actively exploited vulnerabilities.
Notification
Detailed assessment with countermeasures, severity, and affected products.
Final Report
Complete vulnerability report including root cause and measures taken.
Incident Report
Final report for severe security incidents.
Your CRA Compliance at a Glance
Complete Asset Inventories
Systematic capture of digital products, components, and dependencies. Foundation for all subsequent CRA measures.
Vulnerability Management
Continuous identification, assessment, and remediation of vulnerabilities with clear response times per CRA requirements.
Documentation Processes
Structured capture of measures, risk assessments, and compliance evidence – audit-ready and CE-compliant.
Incident Reporting & Obligations
CRA reporting is a regulatory timeline architecture. Manufacturers bear the burden of proof and assessment when a reporting trigger occurs and when the deadline starts.
ISMS & CSMS Integration
Efficiency through integration: Linking ISMS, CSMS, and development processes creates synergies instead of additional bureaucracy.
Team Training
Development and security teams understand Secure-by-Design. Security culture is embedded – for developers, product managers, and executives.
EU CRA Navigator — Are You Prepared?
In collaboration with JUN Legal, we developed the CRA Navigator — a tool for a well-founded initial orientation on the requirements of the EU Cyber Resilience Act.
Impact Check
Immediate assessment of whether and how your products fall under CRA requirements.
Quick Gap Analysis
Quickly identify structural gaps in your security and development processes.
Legally Sound Guidance
Clear classification from secure development methods to vulnerability handling.
Integrated into Your Existing Compliance Structures
5 Steps to CRA Readiness
Complete Asset Inventories
Systematic capture of digital products, components, and dependencies.
Vulnerability Management
Continuous identification, assessment, and remediation with clear response times.
Documentation Processes
Structured capture of measures, risk assessments, and compliance evidence.
Team Training
Development and security teams understand Secure-by-Design; security culture is embedded.
CE Conformity Assessment
Creation of technical documentation, conformity assessment execution, and CE marking per product category.
Our Services for Your CRA Compliance
Product Categories Under CRA
Standard products (smartphones, control software) require a self-declaration. Important Class I (IAM, VPN, routers) require harmonized standards or third-party testing. Critical Class II (firewalls, HSMs, smart cards) mandatorily require assessment by a notified body.
Frequently Asked Questions
Ganzheitliche CRA-Compliance
Ein Ansprechpartner. Zwei Expertisen. Von der technischen Produktprüfung bis zum Cyber Security Management System — alles aus einer Hand.
Valeri Milke
Begleitet Sie persönlich durch Ihre CRA-Compliance — technisch wie organisatorisch.
Technische Prüfung Ihrer Produkte entlang des gesamten Entwicklungszyklus — vom Design bis zur Konformitätsbewertung nach CRA.
- Threat Modeling & Security-by-Design
- Source Code Reviews
- Security-Testing in CI/CD (SAST, SCA)
- Penetrationstests
- Konformitätsbewertung nach CRA
Aufbau tragfähiger Security-Strukturen im Unternehmen — vom Managementsystem bis zu den Meldepflichten gemäß CRA.
- Aufbau & Implementierung des CSMS
- SSDLC-Prozesse & Security-Governance
- Incident Management & PSIRT
- Meldepflichten nach CRA (24 h / 72 h)
- CRA-Compliance-Strategie
Ensure CRA Compliance in Time
From CRA gap analysis to conformity assessment – your partner for secure and CE-compliant products. Book CRA experts now.
Book Consultation