CRA readiness check

Is your connected product ready for the Cyber Resilience Act?

16 questions, about 5 minutes. See where you stand and what to fix first.

Engineers reviewing security documentation on a tablet

Scope

Do you know which of your products fall under the CRA, and whether each is "default", "important" (Class I or II) or "critical"?
Have you set a support period for each product (at least 5 years, unless it is used for less)?

Secure by design

Do your devices ship without shared default passwords, with a secure default configuration and a way to reset to it?
Is every interface (local, cloud API, debug ports) protected by authentication and access control?
Do you use secure boot and signed firmware images?
Is data encrypted in transit and at rest where it matters?
Is the attack surface kept small: unused ports and services closed, debug disabled in production?

Updates

Can you deliver security updates over the air, signed and verified, with rollback protection?
Can security fixes be released separately from feature releases, free of charge, for the whole support period?

Vulnerability handling

Do you have a Software Bill of Materials (SBOM) for each product?
Do you have a published vulnerability disclosure policy and a contact address for security reports?
Do you monitor your dependencies for new vulnerabilities and test your products regularly (code review, scanning, penetration tests)?

Reporting

Could you send an early warning about an actively exploited vulnerability within 24 hours, and a notification within 72 hours?
Do you know who submits reports through the ENISA single reporting platform?

Documentation

Do you have a cybersecurity risk assessment for each product, kept up to date?
Are you preparing the technical documentation, the EU declaration of conformity and CE marking under the CRA for 11 December 2027?

This self-check is general information to help you plan, not legal advice or a conformity assessment.

Contact us

Talk to an engineer, not a salesperson

Idea, prototype, production or a fleet in the field: tell us where you are. A senior engineer replies within one business day.

Your benefits:
  • Senior embedded engineers
  • Hardware, firmware and cloud
  • From prototype to fleet
  • Clear scope and next steps
  • Direct technical answers
  • No sales pitch
What happens next?
1

A free 30-minute call with a senior engineer

2

A short technical discovery

3

A proposal with scope, timeline and cost

Tell us about your project
PDF, Office, images or ZIP, up to 10 MB