One multidisciplinary team
Application security, incident response, risk management, cybersecurity law and CE conformity expertise under one roof.
Consulting
EU CRA Compliance Journey
From the reporting obligations of 11 September 2026 to CE conformity by 11 December 2027: seven work packages, one integrated team, onsite or remote.
- 11 September 2026 Reporting obligations apply: actively exploited vulnerabilities and severe incidents must be reported.
- 11 December 2027 All CRA requirements apply. Products placed on the EU market need CE conformity under the CRA.
Why us
Conformity takes more than reading the regulation
Our team works on the standards that will define how CRA requirements are interpreted, implemented and assessed in practice.
Standards from the source
We hold seats on the CEN/CENELEC and ISO working groups drafting the standards that will define CRA conformity, so we work from the source, not from second-hand interpretation.
Hands-on experience
We've delivered this work on real products: threat modeling, SSDLC improvement, vulnerability handling and CE conformity preparation.
Integrated
Legal, application security, incident response and risk specialists work as one team, so you never have to reconcile different readings of the same CRA requirement.
Fast
We already know the requirements and the standards, so your budget goes into applying them to your products, not into getting us up to speed.
Flexible
Take the full journey or only the work packages your portfolio and maturity call for. Starting right avoids false starts, compliance theater and expensive corrections late in the conformity process.
Work packages
From notification readiness to CE conformity
Each work package covers a distinct part of the transition. Take the full journey, or select the packages you need for particular products, product families, build factories or teams.
-
2026 CRA notification obligations
16 hours per organization
From 11 September 2026, manufacturers must be able to meet the CRA reporting obligations, including for products already on the market that are still supported. Your incident response and coordinated vulnerability disclosure (CVD) policies, and the CSIRT processes behind them, must identify, assess, escalate and report relevant events within the required deadlines.
Deliverables
- Gap analysis of your incident response and CVD policies against the CRA notification requirements
- Gap analysis of your CSIRT procedures and escalation processes
- An actionable plan to close the gaps, including updated policy text where maturity and the timebox allow
Led by
Eden YardeniApplication Security Architect
Senior incident response and digital forensics expert, specialized in the prEN 40000-1-3 vulnerability handling standard.
-
Product context and CRA scope
16 hours per product family
The product context is the foundation for the risk management and security work that follows. We define the product, its intended use, operating environment, system boundaries, stakeholders and dependencies, and which CRA requirements apply, so later risks, controls and conformity decisions rest on solid ground.
Deliverables
- Product context: intended purpose and reasonably foreseeable use, functions, operational environment, high-level architecture, users and distribution of cybersecurity functions
- Business, regulatory and technological context, including remote data processing and the system boundary
- Legal analysis of the horizontal and vertical CRA requirements that apply to the product
Led by
Lara BritoCIPP/E; Data & Technology Lawyer
Data and technology lawyer specialized in data and cybersecurity law, with a focus on OWASP SAMM and the CRA.
-
SSDLC maturity and CRA gap analysis
32 hours per build factory
A clear map of your secure development lifecycle against the CRA's manufacturer obligations, built from stakeholder interviews and a CRA assessment framework based on the legal requirements. It shows where your processes already support conformity, where the gaps are and what has to change. Risk management gets particular attention, because it feeds every product security activity that follows.
Deliverables
- Report on SSDLC maturity against the CRA manufacturer requirements
- EU CRA gap map
- Improvement plan for your risk management methodology
- Minimum roadmap to close the compliance gaps
Led by
Nariman Aga-TagiyevApplication Security Architect
Senior application security architect, national expert at CEN/CENELEC JTC 13/WG 9 (Cyber Resilience Act) and OWASP SAMM core team member.
-
Threat model and product risk assessment
64 hours per product
Every security activity should reduce a product risk that has been identified, assessed and documented. A product security expert runs threat modeling with your product owners, architects and developers. Our risk management expert then combines the product context and the threat model into a structured risk assessment aligned with prEN 40000-1-2. The estimate splits into 32 hours for the threat model and 32 hours for the risk assessment.
Deliverables
- Editable threat model in CycloneDX TM-BOM format, ready for reuse
- Threat model report with the data flow diagram, identified threats and agreed countermeasures
- Risk assessment report structured against prEN 40000-1-2
Led by
Luc PoulinSenior Application Security & Trustworthiness Advisor
Author and editor of ISO/IEC 27034, the standard for integrating security into application management throughout the lifecycle.
-
Vulnerability management program
96 hours per organization
The CRA makes vulnerability handling a long-term obligation: security updates must be available throughout the support period, at no extra cost to users. We build the lifecycle described in prEN 40000-1-3, from policy and intake through triage, remediation, coordinated disclosure and post-release monitoring. If you started with work package 1, that work carries straight over. The estimate covers 80 hours to adapt your policies and 16 hours for training and a tabletop exercise.
Deliverables
- Updated incident response policy
- Updated vulnerability disclosure policy
- Supporting guidance and procedures
- Training and an IR/CVD tabletop exercise for your CSIRT team
Led by
Eden YardeniApplication Security Architect
Our incident response and coordinated vulnerability disclosure lead.
-
Secure by design and secure by default
80 hours per organization
CRA conformity can't be bolted on at the end. Secure-by-design and secure-by-default principles have to show up in how products are designed, developed, tested, hardened and released. We assess your current development practices, controls and policies against prEN 40000-1-4, the horizontal standard manufacturers can use to build these principles into their development lifecycle, and fix the most urgent gaps.
Deliverables
- Secure-by-design and secure-by-default workshop for your development team
- Gap analysis of your secure product development lifecycle against prEN 40000-1-4
- Roadmap for improving your development lifecycle
- Implementation of selected controls within the agreed timebox
Led by
Timo PagelDevSecOps Architect
Senior application security expert with a software development background, practical on real development environments.
-
CE conformity evidence and documentation
40 hours per product
Before a product can carry the CE marking, you need technical documentation that shows the Annex I requirements are met, and an EU declaration of conformity. We consolidate the earlier outputs, including the product context, risk assessment, threat model, SBOM and process evidence, into a conformity file that stands up to scrutiny, and help you pick the right conformity assessment route for your product class. The estimate assumes the earlier work packages are complete.
Deliverables
- The conformity assessment route for your product class: internal control (module A), or third-party assessment where required
- Technical documentation compiled from the earlier work packages and mapped to the Annex I requirements and the standards you apply
- Draft EU declaration of conformity
Led by
Dagmar MoserConsultant, Auditor, and Lecturer
CRA conformity specialist and ISO/IEC 27001 lead auditor, supported by the legal and application security leads of the earlier work packages.
Effort
What it takes
The estimates assume one product, one product family and one build factory. Packages priced per product, product family, build factory or organization scale with the scope you select.
| Work package | Estimated effort | Basis |
|---|---|---|
| 01. 2026 CRA notification obligations | 16 hours | per organization |
| 02. Product context and CRA scope | 16 hours | per product family |
| 03. SSDLC maturity and CRA gap analysis | 32 hours | per build factory |
| 04. Threat model and product risk assessment | 64 hours | per product |
| 05. Vulnerability management program | 96 hours | per organization |
| 06. Secure by design and secure by default | 80 hours | per organization |
| 07. CE conformity evidence and documentation | 40 hours | per product |
| Work packages bought separately: 344 hours (about 43 person-days) | ||
| Full journey: 328 hours (about 41 person-days) | ||
As a full package, the work in package 1 is absorbed into package 5, which saves 16 hours.
The estimates cover the policies, procedures, assessments and documentation the CRA and the EN 40000 standards require. They don't include implementing or operating technical controls such as penetration testing, software composition analysis (SCA), or static and dynamic application security testing (SAST and DAST). We offer those separately, alongside the journey or after it. Once the scope is agreed, we convert the estimate into a fixed fee at our day rate.
Not sure where to start?
EU CRA Internal Audit
In a few days, we put on the auditor's hat and walk through each applicable CRA requirement, checking whether there's sufficient evidence that it's met. You get a list of non-conformities, which shows exactly which work packages you need.
Ask about an internal audit- A requirement-by-requirement review of your evidence
- A list of non-conformities as the deliverable
- A few days of work, a clear starting point
Selling into the EU from outside it?
The CRA applies to every product with digital elements placed on the EU market, wherever the manufacturer is based. That includes software vendors in the US and elsewhere that sell on-premises software to EU customers. We run the journey fully remotely when needed and schedule workshops to fit your time zone.
FAQ
1. Do we have to buy the full journey?
No. Each work package stands on its own, and you can scope packages per product, product family, build factory or organization. Many manufacturers start with the EU CRA Internal Audit or work package 1 and add packages as the gaps become clear.
2. Does the CRA apply to companies outside the EU?
Yes, as soon as their products are placed on the EU market. Manufacturers outside the EU carry the same obligations, and their importers and distributors have to check that those obligations are met. We work with non-EU manufacturers remotely.
3. How is the journey priced?
We estimate effort per work package, as shown above. Once the scope is agreed, we turn the estimate into a fixed fee at our day rate, so there's no open-ended budget.
4. What isn't included?
Implementing and operating technical controls, such as penetration testing, SCA, SAST and DAST. We offer those as separate services and can run them alongside the journey or once the program and documentation are in place.
5. Which standards do you work to?
The CRA itself, the EN 40000 series prepared by CEN/CENELEC JTC 13 WG 9, where we hold a seat, ISO/IEC 27034 and OWASP SAMM. Where a vertical standard applies to your product, the legal analysis in work package 2 identifies it.
6. How long does it take?
The full journey is about 41 person-days of our work for one product, product family and build factory. The calendar time depends mostly on how quickly your team can join interviews and workshops.