CRA Readiness Checker
Assess declared preparation across product security, vulnerabilities, supply chain, reporting, documentation and conformity. Even 100/100 does not establish formal compliance.
Product security
We have a documented product cybersecurity risk assessment.
Secure by design is part of development.
The product has secure defaults.
Vulnerability management
An intake channel and triage process operate.
We can quickly identify affected versions and customers.
We have a process for remediation, testing and update distribution.
Software supply chain
We maintain a release-specific dependency inventory.
We generate and validate SBOMs.
We monitor third-party component vulnerabilities.
Reporting
We have a 24-hour early-warning process.
The 72-hour notification has an owner and backup.
PSIRT, engineering and legal share an escalation path.
Documentation
Technical documentation reflects the current product.
User information and instructions cover secure use.
The support period is defined and justified.
Conformity preparation
We have established the product classification.
We have selected the appropriate conformity route.
We have a plan for the EU declaration of conformity and CE marking.
How to use the result
Answer for the actual product and declared facts. Record the inputs, uncertainty, owner and evidence behind your decision. Changing language does not change answer identifiers, branch rules or calculations.
Save and continue
Your current checker answers can be retained in this browser session to switch language. This is not cloud storage or an independently verified assessment. The printable result retains the selected language and its limitations.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.