Cyber Resilience Act Consulting

Supporting software manufacturers in the technical and organisational preparation for the requirements of the Cyber Resilience Act.

What the Cyber Resilience Act requires from manufacturers.

The Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity requirements for products with digital elements made available in the EU. It covers design and development as well as vulnerability handling and the provision of security updates throughout the support period.

Since 11 September 2026 the reporting obligations for actively exploited vulnerabilities and severe incidents apply; the remaining obligations apply from 11 December 2027. We help you translate the requirements into your development, update and support processes.

Topics

CRA gap analysis
Comparing your products and processes with the essential requirements of the regulation.
Product classification
Classifying your products and determining the resulting conformity assessment procedure.
Secure development lifecycle
Security requirements, reviews and tests as an integral part of development.
Vulnerability management
Processes to receive, assess and fix vulnerabilities, including coordinated disclosure.
SBOM
A software bill of materials in a commonly used machine-readable format, generated automatically during the build.
Dependency management
Monitoring of the components in use and a defined way of handling updates.
Security updates
Providing security updates – separately from functional updates where possible.
Technical documentation
Documentation that traceably demonstrates how the requirements are met.
Support and update processes
Defining the support period and the processes behind it.
Compliance processes
Preparing reporting channels, responsibilities and the EU declaration of conformity.

Approach

  1. Clarify scope

    Which products fall under the regulation, and in which category?

  2. Gap analysis

    Comparing products, development and support processes with the requirements.

  3. Implementation plan

    Prioritised measures with clear responsibilities, aligned with the statutory deadlines.

  4. Support implementation

    Technical implementation – such as SBOM, vulnerability management and update processes – together with your team.

What you get

  • Classification of your products under the Cyber Resilience Act
  • Gap analysis with a prioritised implementation plan
  • Processes for vulnerability handling and reporting
  • Automated SBOM generation in the build process

Our consulting is technical and organisational support and does not replace legal advice. The conformity assessment and – where required – the involvement of a notified body remain the responsibility of the manufacturer.

Let us talk about your products.

Whether it is a secure development process, an ISMS, preparing for the Cyber Resilience Act or controlled use of AI: a first conversation clarifies where you stand and which next step makes sense.

Get in touch