Cyber Resilience Act
We help you to effectively meet the requirements of the EU Cyber Resilience Act. With tailored services such as the CRA Readiness Assessment, we analyze your cybersecurity measures and develop a customized roadmap to ensure compliance.
Our technical expertise in penetration testing, product security analysis, threat modeling and secure software development supports you in designing secure products from the outset. Additionally, we offer support in Coordinated Vulnerability Disclosure (CVD) and collaborate with our partner law firm to ensure that your company implements the CRA requirements in a legally compliant manner.
Start your CRA compliance
Leverage our expertise for a comprehensive EU Cyber Resilience Act compliance
CRA Readiness Assessment
Compliance with the EU Cyber Resilience Act (CRA) requires a structured approach. With our "CRA Readiness Assessment," we systematically analyze your current cybersecurity measures and develop a tailored roadmap with clear priorities. This way, you can target security gaps and establish long-term, effective processes.
Technical Expertise in Product Security
Our extensive experience in penetration testing and product security analyses makes us a strong partner for manufacturers across various industries. We not only identify vulnerabilities but also work with you to develop sustainable solutions for your products.
Security Embedded in the Development Process
Using methods such as Threat Modeling, Secure Coding Training and Source Code Reviews, we help you identify security risks early on and develop secure products from the start. We are happy to advise you on integrating these security activities into your development process to enhance product security sustainably and in the long term.
Efficient Management of Security Vulnerabilities
We assist you in setting up and implementing processes for Coordinated Vulnerability Disclosure (CVD). This includes establishing a public reporting center, analyzing vulnerabilities and communicating with researchers, authorities and the public. We guide you in the professional release of Security Advisories to minimize risks and strengthen trust in your company in the long term.
Legal Advisory
Our partner law firm offers specialized legal advice regarding the EU Cyber Resilience Act (CRA). Support is provided for the legally compliant implementation of CRA requirements and the development of compliance strategies. Additionally, legal opinions are prepared to ensure that your company meets legal requirements and is legally secure.
Reduce risks and enhance trust in your company
- Ensure your cybersecurity measures align with EU Cyber Resilience Act requirements
- Clear priorities to address security gaps and establish long-term, effective processes
- Extensive experience in penetration testing and product security analysis helps identify vulnerabilities
- Ongoing support through regular security reviews (e.g., penetration testing, source code reviews) and process optimization
Holistic support for your cybersecurity needs
With us, you ensure that your products comply with CRA requirements and that your cybersecurity is sustainably enhanced. Through a structured CRA Readiness Assessment, we identify existing gaps. Based on these insights, we support you in implementing necessary organizational processes such as secure software development processes or adjusting your security policies. Through regular security reviews, such as penetration testing and source code reviews, we assist you in ensuring the continuous security of your products.
The Cyber Resilience Act (CRA) sets binding cybersecurity requirements for products with digital elements offered within the EU. The CRA aims to strengthen trust in digital products and increase security in the European market.
The goal is to ensure a high level of security throughout the entire product lifecycle. Manufacturers must meet the following requirements:
- Ensure product security in all development phases, such as through Threat Modeling, Secure by Design, and Secure Coding.
- Ensure the market launch of secure products, free from known and exploitable vulnerabilities.
- Create and maintain a Software Bill of Materials (SBOM) and continuously monitor vulnerabilities.
- Conduct regular security tests to identify potential risks early.
- Implement Coordinated Vulnerability Disclosure (CVD) to manage vulnerabilities effectively.
- Report actively exploited vulnerabilities to relevant authorities such as CERTs.
- Provide proof of compliance through CE marking, potentially supplemented by additional requirements such as EU-CC.
The Cyber Resilience Act (CRA) applies to companies offering products with digital elements within the EU if your product:
- contains digital elements or is a software product.
- is sold on the EU market. The CRA applies to new products launched after the end of 2027, as well as to existing products that are significantly modified through changes in hardware or software.
- does not belong to the following five exempt sectors: medical technology, vehicles, civil aviation, and products related to national security.
- is not free open-source software without a profit motive.
The CRA applies to all products with digital elements offered in the EU, including hardware, software, and IoT devices. Services necessary for the operation of these products, such as cloud services, may also be affected. Every company should conduct a thorough analysis to determine which products or services are relevant under the CRA.
The CRA requires companies to implement cybersecurity measures throughout the entire product lifecycle. These include:
- Ensuring product security during development (e.g., through Secure by Design).
- Avoiding known vulnerabilities before market launch.
- Creating and maintaining a Software Bill of Materials (SBOM).
- Conducting regular security tests.
- Implementing a Coordinated Vulnerability Disclosure (CVD) process.
- Reporting actively exploited vulnerabilities to relevant authorities.
- Providing proof of compliance, such as through CE marking.
A structured approach helps you implement the CRA requirements efficiently and sustainably.
- Conduct a CRA Readiness Assessment: Review the status of your products and processes.
- Create a Roadmap: Define clear actions to close security and process gaps and meet the CRA requirements.
- Organizational Processes: Implement a Secure Development Process (Secure Coding, Threat Modeling, Risk Management, SBOM Maintenance) and a Coordinated Vulnerability Disclosure (CVD) process.
- Product-Specific Security Requirements: Ensure that your product meets the technical requirements of the EU Cyber Resilience Act (CRA) through regular and effective security tests, in line with your Threat Model and Risk Management (protection of integrity, confidentiality, authentication/authorization, Secure by Design, data minimization, least-privilege principle, no known vulnerabilities, etc.).
- Provide Proof of Compliance: Ensure that your products carry the necessary certifications.
We provide comprehensive support to companies on their path to compliance with the EU Cyber Resilience Act (CRA). First, we clarify whether and to what extent your products are subject to the requirements of the CRA - if necessary, in close cooperation with a specialized partner law firm.
We then carry out a structured CRA readiness assessment to identify existing gaps. This process includes workshops and technical analyses, such as penetration tests, to specifically uncover both organizational and technical vulnerabilities.
