Technical Assurance & Offensive Security

Cyber Resilience Act Readiness

If you ship a product with digital elements into the EU, the clock is already running.

The situation

The Cyber Resilience Act entered into force on 10 December 2024. Reporting obligations for actively exploited vulnerabilities apply from 11 September 2026, and the full obligations — essential cybersecurity requirements, conformity assessment and CE marking — from 11 December 2027.

Manufacturers, importers and distributors of connected products, and increasingly their software suppliers, need a compliance programme now rather than in 2027.

What the client receives

Schedule of deliverables

01Product scope and risk classification (default / important / critical)
02Annex I essential requirements gap assessment
03Vulnerability handling process and coordinated disclosure policy
04Article 14 reporting procedure for actively exploited vulnerabilities
05SBOM and secure-update capability design
06Technical documentation and conformity assessment route planning

Frameworks and standards

Assessment is carried out against named references, so a conclusion can be traced back to the requirement it was measured against.

Regulation (EU) 2024/2847 (CRA)
Harmonised standards as published
NIST SSDF
ISO/IEC 29147 / 30111

Technical Assurance & Offensive SecurityPenetration TestingInfrastructure, web, API, mobile and cloud testing with findings you can act on.Service detail Technical Assurance & Offensive SecurityDevSecOps & Secure Development EnablementSecurity inside the pipeline, owned by the engineers, not queued behind a review board.Service detail

Discuss this engagement

Tell us about the product with digital elements and the market you place it on and we will set out the scope, the method and the reporting format.