CRA Compliance & Readiness Checklist

Assess your CRA readiness

The Cyber Resilience Act (CRA) sets essential cybersecurity requirements for every product with digital elements made available on the EU market. Before starting a compliance project, it helps to see where your product stands today. This checklist walks you through product classification and the core requirements of the CRA, so you can identify open points early.

What this checklist covers

The checklist follows the structure of the CRA and is organised in six sections:

• Product Classification: Default, Important Class I, Important Class II or Critical, and what the category means for the available conformity assessment procedures.
• Risk Assessment and Support Period: the two items that the requirements below build on.
• Essential Cybersecurity Requirements (Annex I, Part I): secure by design, secure by default, access protection, confidentiality, integrity, attack surface and more.
• Vulnerability Handling (Annex I, Part II): SBOM, remediation, security testing, coordinated vulnerability disclosure and secure update distribution.
• Reporting to Authorities (Art. 14): early warning within 24 hours, notification within 72 hours and the final report.
• Documentation and Conformity: technical documentation, EU declaration of conformity, CE marking and record keeping.

By downloading this checklist, You will be able to:

• Identify your product's category: see which category applies and which conformity assessment procedures are available for it.
• Check your design practices: review your product against the requirements of Annex I, Part I.
• Review your post-market processes: check your SBOM, vulnerability handling and reporting processes against Annex I, Part II and Art. 14.
• Spot open points early: turn each unticked item into a starting point for a gap analysis.

Please note: This checklist is a self-assessment aid. It does not constitute a conformity assessment or evidence of CRA compliance. Ticking every box does not mean that a product is compliant.

Why Choose CCLab?

• Deep Technical Expertise: Our team includes 10+ certified evaluators and 10+ information security experts.
• Proven Track Record: With 13 years of experience in Common Criteria, we have successfully completed 80+ projects for 50+ satisfied clients.
• Agile Methodology: We offer understandable, solution-oriented workflows with continuous feedback and adaptive processes.
• Comprehensive Support: From CRA Gap Analysis to technical documentation support and final Conformity Assessments, we guide you every step of the way.
• State-of-the-Art Facilities: We utilize modern labs and techniques to ensure efficient and timely project delivery.

‍