CRA readiness for one product, in 10 working days
Remote work with you, in StandardOS: whether and how the Cyber Resilience Act reaches your product, where the product stands against Annex I, reporting set up, and the technical file started.
- What you get
- The scope determination, the Annex I gap list for your product, reporting set up, and the technical file started in StandardOS, with a call to open and a call to close.
- How long
- 10 working days from the opening call
- Price
- €1,500 fixed, excl. VAT, paid up front
- What you provide
- One product, a person who knows it, and its documentation.
Ask for a start date
What is delivered
1Scope determination
Whether the Act reaches the product, which class it falls in (default, important or critical), and which conformity route that opens, each with the Article or Annex it rests on.
2Annex I gap list
Every essential requirement of Annex I read against your product: met, partly met or open, with what would close each open one.
3Reporting set up
The four readiness marks in StandardOS: scope decided, the coordinating CSIRT named, a reporting owner and a deputy named, and both registered on ENISA's single reporting platform with EU Login.
4Technical file started
The technical file opened in StandardOS with the scope and the gap list in it, and the remaining sections listed, each with an owner.
5An opening call and a closing call
The first agrees the product and the sources; the last walks through the result and what is left to do. Between them the work happens in writing, in the workspace.
6StandardOS during the work
A workspace for the engagement, where every document is kept, and which stays yours afterwards.
What we need from you
- One product with digital elements, named at the opening call. A second product is a second engagement.
- A person who knows how the product is built and updated, for the two calls and for questions in writing.
- Its documentation: architecture, components, the update process and any security testing, in whatever form it exists.
What this does not promise
It does not make the product conformant or give it a CE marking: that follows the conformity assessment, and for some product classes a notified body decides. The gap list says what is open; closing it is your work, and StandardOS keeps track of it.
StandardOS is included while we work. When the engagement ends, your workspace continues on the ordinary subscription, or you export everything and leave.