CRA portfolio assessment

Three weeks, fixed scope: where every product stands against the Cyber Resilience Act, what it will cost, and what to decide first.

Most CRA programmes stall on the same question: where do we actually stand, and what will it take? Engineering has a view, compliance has another, and the board has a deadline. The portfolio assessment answers the question in three weeks, with a fixed scope and a fixed price, so that the next decision is an informed one.

It is the first step of every engagement we run, and the only one you need to commit to.

Who it is for

Executives with a deadline

You need a decision basis for the board: exposure, cost, timeline and priorities, in three weeks rather than three months.

Product organisations with a portfolio

Several product lines, shared platforms, products with and without radio: you need one picture across all of them, not one assessment per product.

Compliance managers without a product security team

You carry the CRA alongside other duties and need the gaps named and prioritised by someone who has done it before.

Manufacturers already through RED

You have an EN 18031 file and a process: the assessment tells you what carries over and what the CRA adds.

What you receive

Portfolio scoping table

Every product with digital elements, its CRA category and conformity route, its market dates and its support period, in one table your management can read.

Products out of scope are listed with the reason, so the question is settled.

Gap analysis

Your processes, documentation and a representative product family assessed against the essential requirements of Annex I, product properties and vulnerability handling, organised by our five objectives.

Each gap is rated by risk and by the effort to close it.

Prioritised roadmap

The gaps sequenced by dependency and by launch date: what to do this quarter, what can wait, and which foundations serve the whole portfolio.

Written as engineering tasks and process changes, not as a list of articles of the regulation.

Budget range and executive readout

A budget range for the first product and for the portfolio, split into foundations, per-product and running costs, and a ninety-minute readout with your executive committee.

You leave the readout with the decisions taken or scheduled.

What it is not

The assessment does not write your technical file, test your products or fix the gaps. Those are the follow-on work, and the roadmap tells you which of them you need, in what order, and which your own teams can do. Everything we produce is yours, whether or not you continue with us.

How it runs

Three weeks from kick-off to decision

The assessment is designed around your teams’ time: two days of workshops in total, the rest is our work.

  1. Week 1: scoping

    A kick-off with product management and compliance, then the portfolio: every product with digital elements, its CRA category, its market dates and its support period.
  2. Week 2: assessment

    Workshops with the engineers of a representative product family, and a review of your processes and documentation against the essential requirements of Annex I, parts I and II.
  3. Week 3: roadmap and readout

    Gaps prioritised by risk and by launch date, a budget range, and a ninety-minute readout with your executive committee, with the decisions to take.

Scope and price

The assessment covers one legal entity and its full portfolio for scoping, with the detailed gap analysis on the products you choose. It takes three weeks from kick-off, with two workshop days from your teams.

The whole portfolio

20,000 €

one legal entity, up to ten products

Compliance evaluation against Articles 13 and 14 and the CRA essential requirements, across every product category you sell. Beyond ten products we quote, because the work grows with the portfolio.

The right size for a manufacturer spanning several product categories, where the question is which products carry the obligations and in what order.

One product

5,000 €

fixed

Compliance evaluation against the CRA essential requirements, or against the applicable harmonised standards where they exist.

The right size for a small manufacturer, or for a first product taken all the way through before the rest follow.

Both end with the prioritised roadmap: what to fix, in what order, and what it will take. Anything between the two is quoted on the same basis.

The price is fixed, and confirmed with the scope before the kick-off: what you are quoted is what you pay. A portfolio means one legal entity, because each one carries its own obligations under the Act. A group that sells through several is quoted per entity.

Next step

Book the assessment

Tell us about your portfolio and your deadlines. We confirm the scope and the start date within a week, and the readout lands on your executive committee’s agenda three weeks later.