Cyber Resilience Act (CRA) Readiness & Product Security

Tool and service

CRASteps is the tool we use to structure risk categories under Annexes III and IV, verify Annex I essential requirements, record software components and SBOMs, and uncover conformity gaps prior to CE marking. The technical assessment, threat modeling, and remediation roadmap are the SKOPION Intelligence service. A tool replaces neither manufacturer conformity assessment nor the assessment of a Notified Body.

How it runs

1. 01Product classification: Scoping and categorisation (Default, Important Class I/II, Critical products with digital elements).
2. 02Requirements review: Evaluation against Annex I Part I essential cybersecurity requirements (secure by design, integrity, confidentiality).
3. 03SBOM & vulnerability handling: Supply chain analysis, Software Bill of Materials (SBOM) review, and 24h vulnerability notification readiness under Annex I Part II.
4. 04Gap analysis & documentation: Review of technical documentation under Annex VII and selection of the conformity assessment module.
5. 05Executive briefing: Delivery of an actionable remediation and hardening roadmap ahead of statutory enforcement dates.

What you receive

• A documented and reasoned product classification under Regulation (EU) 2024/2847.
• A structured gap analysis comparing requirements, design decisions, and available evidence.
• A specific vulnerability handling and SBOM governance assessment with identified risk priorities.
• A step-by-step action roadmap for technical documentation and CE marking.
• A technical assessment report in English, German, or Polish.

What this is not

• Not a certification issued by a Notified Body for Class II or critical products.
• Not formal legal counsel; the EU Declaration of Conformity remains the statutory responsibility of the manufacturer.
• Not an automated surface scan without product architectural verification.
• Does not transfer manufacturer, importer, or distributor statutory liability.

Frequently Asked Questions About the Cyber Resilience Act

What does the EU Cyber Resilience Act (CRA) mandate?

Regulation (EU) 2024/2847 requires manufacturers of products with digital elements to implement security-by-design, vulnerability handling processes, and CE conformity marking.

What are the key enforcement deadlines for the CRA?

Vulnerability reporting obligations apply 21 months after entry into force (mid-2026), and full product security compliance becomes mandatory 36 months after entry into force (late 2027).

How does SKOPION support product manufacturers with CRA readiness?

We evaluate digital architectures, establish SBOM automation, audit vulnerability response workflows, and conduct technical readiness assessments using our evaluation tool CRASteps.