Digital product security
Cyber Resilience Act (CRA)
Adaptation of products with digital elements to the European Cyber Resilience Regulation.
What it involves
What we do
The CRA requires manufacturers, importers and distributors of products with digital elements to meet essential security requirements, manage vulnerabilities and report incidents. We determine how your products are classified and the path to CE marking.
What's included
- Applicability analysis and product classification
- Gap assessment against the Annex I essential requirements
- Vulnerability management and reporting processes
- Technical documentation, SBOM and declaration of conformity
- Preparation for the conformity assessment
- Integration with ISO 27001, IEC 62443 and product security
Who it's for
- Software and hardware manufacturers with digital elements
- Importers and distributors in the EU
- Connected product and IoT companies
Deliverables
- Applicability report
- CRA gap assessment
- Adaptation plan and technical documentation
Reference frameworks and standards
Reference frameworks used to design, implement, review and evidence. They are not presented as our own certifications unless contractually applicable.
How we approach it
- DiscoverWe get to know your business, environment, risks and priorities.
- AnalyseWe assess maturity, exposure, compliance and real capabilities.
- DesignWe define strategy, roadmap, architecture and action plan.
- ImplementWe deliver controls, processes, technology and evidence.
- OperateWe monitor, respond and support continuous improvement.
- OptimiseWe measure results, reduce risk and evolve capabilities.
Related services
More in Digital product security
Product Security
Product security programme for software, SaaS and connected devices.
Prevent- Product security programme
- Threat model
- Security-by-design evidence
PSIRT
Product security incident response team and coordinated disclosure.
Prevent- Operational PSIRT
- Disclosure policy
- Security advisory templates
SBOM
Software component inventory and supply chain vulnerability management.
Prevent- SBOM per product and version
- Automated process
- Component vulnerability reports
AppSec
Security for web, API and mobile applications across their entire lifecycle.
Prevent- Review report
- Tools integrated into the pipeline
- Training plan
SecDevOps
Security built into the development and deployment cycle, not bolted on at the end.
Prevent- Secure pipeline
- Guidelines and policy as code
- DevSecOps maturity report
Let's talk
Does Cyber Resilience Act (CRA) fit your situation?
Tell us about your challenges and let's design together the best strategy to protect and strengthen your business.