CRA Readiness Assessment
A CRA readiness assessment maps a real product and its evidence against the regulation. It turns an uncertain compliance task into a prioritised engineering roadmap with a documented classification and conformity route.
What you get.
- Classification and conformity route review
- Validated, release-specific SBOM
- Triaged vulnerabilities and draft VEX
- Gap analysis against 21 Annex I requirements
- Reporting readiness review
- Roadmap to December 2027 and results call
What we need from you
Build and release ownership, access to agreed artifacts, existing security documentation and a technical contact who can answer architecture questions. Class I candidates start at 3500 EUR.
What is outside the scope
Assessment and recommendations. Remediation engineering and implementation documents are priced in a separate project.
We document assumptions and evidence gaps rather than treating a scan as proof. Every accepted deliverable has an owner and a review step. Your engineers can inspect how findings relate to the release and which decisions still need confirmation.
Learn how this work fits the Cyber Resilience Act, the SBOM requirements and the Article 14 reporting process.
From access to usable evidence.
Set the boundary.
Identify the product family, supported versions, build inputs, data location and authorised access. Agree a named contact and the deliverables before we start.
Build the evidence.
Connect inventory to the release. Check findings with the people who know the code. Record decisions with article references and identify what needs engineering attention.
Make the handover useful.
Review the findings together. Separate verified facts from open questions. Assign owners, next actions and dates so the work survives the next product release.
Before we start.
Who remains responsible for compliance?
The manufacturer remains accountable for classification, conformity decisions, reporting and signing the declaration. We prepare evidence and drafts and help with engineering work.
Can we start without sharing all our source?
Yes. We agree the minimum inputs first. An existing SBOM or build output can be a starting point. If those inputs cannot support a conclusion, we document the limitation and agree what is needed next.
What are the payment terms?
Project work is 50% upfront, with the remainder according to the agreed milestones. Invoices are in EUR, excluding applicable VAT. Subscription scope and billing are agreed before activation.
Do you handle certification or penetration testing?
No. Accredited partner labs carry out testing, and notified bodies handle routes that require their involvement. Their fees and scope are agreed separately.
Let's see what your
product needs.
Start with a free Snapshot. We agree the inputs and authorisation before reviewing your build.