CRA check
We assess which of your products are affected, which category they fall into and where you stand today. The result is a prioritised action plan.
Cyber Resilience Act
Get your machines and devices ready for the Cyber Resilience Act
With the Cyber Resilience Act (CRA), cybersecurity becomes a requirement for the CE marking. We show you what the CRA means for your products and implement the requirements with you: in software, firmware and processes.
What the CRA requires
Cybersecurity across the whole product life cycle
The CRA applies to almost all products with digital elements and a data or network connection sold in the EU: controllers, gateways, HMIs, connected machines and software. Most obligations fall on the manufacturer.
Security by design
Products must ship without known exploitable vulnerabilities, with a secure default configuration, access control and a limited attack surface.
Vulnerabilities under control
Manufacturers need a software bill of materials (SBOM), a vulnerability handling process and a public reporting contact.
Updates for years
Security updates must be available for the whole support period, usually at least five years.
Early warning within 24 hours
Actively exploited vulnerabilities and severe security incidents must be reported: an early warning within 24 hours, a notification within 72 hours and a final report after that.
Deadlines
The first obligations already apply
Violations can be fined up to 15 million euros or 2.5% of worldwide annual turnover. If you start now, you have enough time to adapt products and processes without rushing.
- 10 December 2024: The CRA (Regulation (EU) 2024/2847) enters into force.
- 11 September 2026: The reporting obligations apply, including to products already on the market.
- 20 January 2027: The new Machinery Regulation applies, with its own requirements for protection against corruption.
- 11 December 2027: All obligations apply. New products only get the CE marking if they comply with the CRA.
Services
We help where you need it
From the first overview to implementation in your product. You decide which parts you handle yourself and where you bring us in.
Risk assessment
A structured threat and risk analysis of your product as the basis for requirements and technical documentation.
Security by design
We implement the requirements in software and firmware: hardening, authentication, encryption and secure defaults.
SBOM & open source
Software bills of materials and licence and vulnerability checks of the components you use, following our own OpenChain processes.
Penetration testing
We test devices, interfaces and software for vulnerabilities before attackers do, and help you fix them.
Updates & reporting
Secure update mechanisms, vulnerability management and a reporting process that actually meets the 24-hour deadline.
Approach
Four steps to CRA compliance
- 01
Assessment
We capture your products, their software and your existing processes and map them to the CRA requirements.
- 02
Action plan
You get a prioritised plan with effort and order, matched to your deadlines and resources.
- 03
Implementation
We implement the technical measures with your team and verify the result with penetration tests.
- 04
Operation
Vulnerability management, updates and reporting keep running. We stay at your side.
Why UpTux
Security from practice, not from paper
Documents alone won't make you CRA compliant. The requirements have to reach your software, and that is exactly our craft.
- Experience with critical systems: More than 15 years of software development for safety-critical systems including automation and automated driving.
- We know the attack paths: As penetration testers we know where connected machines are vulnerable.
- Open source under control: UpTux is self-certified under OpenChain ISO/IEC 5230 and ISO/IEC 18974. We bring these processes into your project.
- Right-sized for SMEs: Pragmatic solutions at a scale your team can sustain in the long run.
This page is an overview and does not replace legal advice. To see how we handle open source software ourselves, read our open source compliance page.
Do you know what the CRA means for your products?
Tell us which machines or devices you make. We'll get back to you with an honest assessment of what's coming and where to start.