CRA Services
From Regulation to Reliable Products
We help you translate the EU Cyber Resilience Act into practical, secure development practices. From GAP analysis and process design to retrofit, implementation, and auditing support, our CRA services ensure your connected products remain compliant, secure, and ready for the European market.
CRA Compliace Packages and Cybersecurity
With our packages we will get your products with digital elements CRA-ready in order to keep your cashflow running. Choose up to your needs.
GAP-Analysis
Your development processes for your products with digital elements
- Inventory: Delta for a secure development process according to standards
- Highlighting standards of good practice
- Report with action points
Implementation
Achieving CRA compliance for your products with digital elements
- Retrofit of existing products
- Complete reimplementation
- Securing the development process (supply chain, SBOM, vulnerability, update, and incident management)
Auditing
Validation of established development processes by an auditing body
- Through established institutions
- e.g., according to IEC 62443-4-1, BSI-TR-03183, ISO 27001 with ISO 27005, or ISO 33001 for risk management
- Prove CRA compliance
Security built into your code
Secure coding
Retrofit – Encapsulation & Securing of Existing Products and Components.
In cases where updating existing software is no longer possible or economical, we offer a targeted retrofit concept. Old systems are transferred to a controlled and protected environment (e.g., virtual machines or containers). There, secure operation is ensured by regulating access and shielding known vulnerabilities. This keeps products usable and CRA-compliant at the same time.
Reimplementation of the product – the most sustainable solution for CRA readiness is complete reimplementation.
We rely on future-proof software architecture, security by design, test automation, and comprehensive documentation of security-related requirements. Dependency checks and integrated tool landscapes ensure automated compliance documentation. Existing customer systems and tools are integrated.
Supplementing internal development capacities – our experts provide direct support to customer teams.
Using established methods, we ensure the implementation of CRA requirements in existing projects and strengthen internal competencies.
Turning SSDLC from theory into practice
Process management for the Secure Software Development Lifecycle (SSDLC)
The Secure Software Development Lifecycle (SSDLC) is implemented as a continuous process that supplements the classic phases of software development (planning, design, implementation, testing, deployment, and maintenance) with systematic security aspects. The goal is for each phase to produce clear security deliverables that are documented and verifiable for compliance management in accordance with CRA. An SSDLC according to IEC 62443-4-1 and ISO/IEC 27002 is based on a cyclical approach that can be divided into four levels:
Requirements analysis and threat modeling
Secure design and architecture
Secure implementation and integration
Verification, validation, and handover to operation
Each level is in turn permeated by processes for risk management, documentation, and communication.
Make complexity easy to explain
Support with technical and customer documentation
Documentation is a key element of CRA compliance. It creates transparency and traceability and forms the basis for audits by market surveillance authorities or notified bodies. Annex II and other sections of the Cyber Resilience Act (CRA) expressly require the creation and provision of:
Technical documentation for authorities and testing bodies
Customer documentation for end users
CE declaration and manufacturer's declarations of conformity.
The challenge for companies is to view documentation not as a chore, but as an integral part of the development process. A systematic approach ensures that documentation is created efficiently, standardized, and audit-proof. Support for technical and customer documentation in the context of the CRA means:
Standardization of processes
integration into the SSDLC
Automation to increase efficiency
Verifiability for audits and authorities
With a consistent approach to documentation, companies ensure that they are auditable, transparent, and CRA-compliant at all times. The combination of technical depth for authorities, understandable language for users, and legally compliant CE declarations creates trust and reduces costs in the long term.
Clarity on your process gaps
GAP analyses and assessments at the process level
GAP analysis is a key tool for assessing an organization's maturity level with regard to the requirements of the Cyber Resilience Act (CRA). It provides a structured overview of which elements of the Secure Software Development Lifecycle (SSDLC) have already been implemented, where there are deficits, and what measures are necessary to achieve compliance. We analyze existing software development processes, starting with requirements analysis and continuing through design, implementation, and testing. Particular attention is paid to verification/validation, dependencies, and libraries. We evaluate established processes, templates, and security incidents. The end result is a report highlighting strengths, weaknesses, recommendations for action, and an implementation plan.
Our GAP analysis lays the foundation for preparing organizations specifically for CRA. Based on a thorough assessment, companies and authorities will know at the end of this phase exactly what challenges still stand in the way of CRA compliance and how these can be systematically addressed.
From assumptions to verified security
Technical investigations – security verification and validation
Security verification and validation (SVV) are crucial phases in the life cycle of a product with digital elements. The goal is to ensure that the security requirements defined in the Secure Software Development Lifecycle (SSDLC) are not only implemented but also demonstrably effective. We support the implementation of security requirements through a structured approach from design to testing. Deliverables:
Test plans
Test reports
Security reports
The close integration with vulnerability, incident, and update management is highlighted and presented to stakeholders in a comprehensible manner. This makes security verifiable, reproducible, and regulatory-compliant. The entire SSDLC also becomes understandable in its context for all parties involved in the security process. Security verification and validation are not just technical testing tasks, but a strategic component of CRA readiness.
From awareness to real competence
Academy – Coaching & Training
Implementing the requirements of the Cyber Resilience Act (CRA) requires not only processes and technical measures, but above all competence and awareness in the teams involved. With our Academy, we offer a structured program that helps companies systematically prepare their employees and managers for CRA compliance. It combines practical coaching with structured training. In this way, we ensure that organizations not only establish processes and documentation, but also develop the necessary expertise to implement them on a permanent basis.
Coaching
Our experts provide individual support to companies, give practical input, and ensure sustainable anchoring (help for self-help and train the trainer, blended learning).
Mandatory training
Workshops and training courses on CRA requirements and their implementation. Role-based training for developers, management, and operations. Documented evidence supports audits.
Proving compliance, building trust
Certification and conformity assessment
The Cyber Resilience Act (CRA) requires manufacturers of products with digital elements to demonstrate their compliance. Depending on the product category, internal assessments, audits by notified bodies, or formal CE markings are required. Our certification and conformity assessment services help companies meet these requirements securely, efficiently, and transparently. Our services ensure that companies act in an audit-proof and legally compliant manner. From auditing and setting up a CE process to testing, we provide our customers with comprehensive support, laying the foundation for long-term CRA readiness.
Auditing
Conducting audits in accordance with IEC 62443 and ISO/IEC 27001. Focus on SSDLC, risk management, and vulnerability handling. Results in standardized audit reports.
CE process
Setting up workflows for CE and manufacturer declarations. Collecting and structuring evidence, conducting pilot projects for testing, integrating into existing management systems.
Coordinating your path to compliance
Project management for CRA readiness
Implementing the requirements of the Cyber Resilience Act (CRA) is not a one-time project, but a company-wide transformation task that affects development processes, product strategies, and organizational structures. Many companies face the challenge of implementing regulatory requirements in parallel with ongoing development and market activities. This is where our CRA readiness project management comes in – we take responsibility for planning, control, and implementation so that organizations achieve compliance on time, efficiently, and verifiably.
Helping you choose CRA-ready products
Supporting the organization in procuring compliant products
The Cyber Resilience Act (CRA) not only obliges manufacturers, but also affects the procurement processes of organizations. Companies must ensure that the products they use with digital elements comply with regulatory requirements. We support organizations in systematically selecting, evaluating, and procuring compliant products.
Empowering users to work securely
User training and enablement
The full benefits of a CRA-compliant product can only be realized if user organizations are also empowered to use these products safely and efficiently. We ensure that customers have the right processes, skills, and structures in place to successfully operate CRA-ready products. This includes:
Listing products in the client's own dependency tracking systems
Verifying users' understanding of customer documentation
Taking product characteristics into account in your own risk and opportunity management
Connecting you with the right CRA specialists
Distribution and referral of third parties (specialist teams) for individual disciplines and subject areas of the CRA
Not every company has the internal capacity or specialized expertise to cover all disciplines of the Cyber Resilience Act (CRA) in the necessary depth. The CRA is a cross-cutting issue that combines technical, organizational, legal, and regulatory aspects. With the 'Third-party sales and brokerage' service, we are expanding our service portfolio to a modular ecosystem for CRA compliance. Customers benefit from a network of specialized experts who can be specifically involved in all subject areas of the Cyber Resilience Act – efficiently, legally compliant, and from a single source.
Security built into tools, workflows, and access
Technical and organizational controls in the development environment
A secure development process requires not only defined methods and processes, but also a secure development environment. Development and test environments are attractive targets for attackers, as they provide early access to source code, build artifacts, and confidential information. The CRA therefore requires the documented implementation of security measures covering technical controls (tools, systems) and organizational controls (guidelines, processes, roles). A secure development environment forms the foundation for CRA-compliant products. Only when both technical and organizational controls are consistently implemented can the integrity of the development process be guaranteed.
Companies benefit from:
Protection against supply chain attacks
Verifiable CRA compliance
Trust from market regulators and customers
Increased efficiency through standardized processes.
Clear, structured communication with customers and regulators
Communication processes with customers and market regulators
A secure development process does not end with the creation of source code or the performance of tests. For a product to be considered compliant under the Cyber Resilience Act (CRA), manufacturers must establish clear communication processes with all relevant stakeholders.
These include:
Customers and end users who depend on transparent information about security, updates, and support.
Market surveillance authorities, which expect evidence, documentation, and security reports as part of their role as a supervisory body.
Partners and suppliers who are involved in the supply chain and must fulfill their role in vulnerability management.
Without a structured flow of information, there is a risk of delays, legal uncertainty, or even fines. Communication processes are a central component of CRA compliance. They ensure transparency, strengthen the trust of customers and market regulators, and create a solid foundation for legally compliant action.
A company that establishes clear communication processes achieves:
Faster response times in the event of a security incident
Avoidance of regulatory sanctions
Greater trust in the market through demonstrable openness
Increased efficiency through standardized procedures
Activities in this area are covered by the status of authorized representative within the CRA.
FAQs
Frequently Asked Questions
Answers to the most important questions about CRA readiness, secure development, and our approach to compliance.
What do we do for the other roles in the CRA?
Customers: Training courses and documents as well as instructions for manufacturers on behalf of consumer protection organizations.
Importers: Securing purchased products
Distributors (customer management): Acting on behalf of distributors, where manufacturers are unable or unwilling to do so
White-label manufacturers: Due diligence with manufacturers.
Ready to make your products CRA-ready?
Whether you need a first GAP-Analysis, hands-on implementation support, or independent auditing – we’ll help you find the right CRA package for your products and organization. Get in touch and we’ll discuss your specific situation in a short, focused call.