Sample HTML. Lorem ipsum dolor sit amet, consectetur adipiscing elit nullam nunc justo sagittis suscipit ultrices.

EU Cyber Resilience Act

CRA Readiness Navigator

From CRA uncertainty to evidence-ready product security

Fortis Lumen combines structured assessment automation with senior product-security judgment to establish what applies, assess product-specific evidence, identify engineering and lifecycle gaps, and define practical actions and closure evidence.

Find Your Starting Point Article 14 Operational Readiness
CRA READINESSARTICLE 14VULNERABILITY HANDLINGTECHNICAL EVIDENCEIMPLEMENTATIONEVIDENCE CONFIDENCEEXPERT VALIDATION
  1. 01CRA requirement
  2. 02Product risk
  3. 03Cybersecurity requirement
  4. 04Implementation
  5. 05Verification
  6. 06Evidence

From CRA requirements to defensible product evidence

CRA readiness is more than completing a questionnaire or collecting documents. Fortis connects applicable requirements to product risk, cybersecurity requirements, implementation, verification, evidence and lifecycle ownership — helping teams identify not only what is missing, but what is required to close the gap.

AI-accelerated. Expert-validated. Evidence-driven. The speed of structured assessment automation, the depth of engineering analysis and the accountability of senior expert review. Fortis supports readiness, evidence and implementation; certification, conformity decisions and regulatory accountability remain with the responsible economic operator and, where applicable, the relevant conformity assessment body.

Where should you start?

The right entry point depends on how far your organization has already gone. Find the statement closest to your situation.

"I don't know whether CRA applies to us."

START WITH →Free CRA QuickCheck

"I know CRA is relevant but need an initial picture."

START WITH →CRA Scope & Readiness Snapshot

"Article 14 reporting is my immediate concern."

START WITH →Article 14 Operational Readiness Sprint

"I need a comprehensive evidence-based CRA assessment."

START WITH →CRA Evidence Readiness Assessment

"We already know our gaps and need engineering support."

START WITH →CRA Gap Closure & Engineering Support

From CRA uncertainty to evidence-ready product security

Start with a preliminary scope check, then move through expert-validated assessment, operational reporting readiness and targeted engineering support. Each service has a defined purpose so you invest at the level your product actually needs.

Initial OrientationCRA_INITIAL_CHECK_FREE

Free CRA QuickCheck

FREE
No cost

Request a free preliminary CRA QuickCheck to receive an initial indication of CRA relevance and the next area to review.

Best for: teams beginning their CRA journey or deciding whether a structured review is needed.
  • Preliminary CRA scope indication
  • EU-market and product-connection screening
  • Sectoral/interplay and economic-operator flags
  • Recommended next step
  • No evidence review, readiness score or compliance determination
Request Free CRA QuickCheck
Focused ReviewCRA_READINESS_SNAPSHOT

CRA Scope & Readiness Snapshot

From 12,900 SEK
excl. VAT

A decision-grade first view of CRA relevance, product boundary, likely obligations and the work that should be funded next — without duplicating the full evidence assessment.

Best for: manufacturers needing an expert first view of scope, likely obligations and investment priorities.
  • Product, market and economic-operator context
  • Initial product-boundary and RDPS screening
  • Scope and conformity-route candidate view
  • Article 14 applicability screening
  • Top priorities and recommended work package
  • Management briefing — no Annex I clause-by-clause scoring
Request CRA Scope & Readiness Snapshot
Reporting PreparednessCRA_ARTICLE14_REPORTING_READINESS

CRA Article 14 Operational Readiness Sprint

From 24,900 SEK
excl. VAT

Test whether your organisation can detect, decide, escalate and support reporting within CRA Article 14 timeframes before a real event puts the process under pressure.

Best for: manufacturers with products on the EU market that need operational reporting confidence now.
  • Article 14 applicability and responsibility review
  • 24-hour, 72-hour and final-report workflow
  • Reportability decision logic
  • RACI, PSIRT and supplier escalation interfaces
  • Reporting evidence log and template pack
  • Facilitated tabletop exercise
  • Prioritized improvement actions
Request Article 14 Readiness Sprint
Implementation SupportCRA_IMPLEMENTATION_ADVISORY

CRA Gap Closure & Engineering Support

Tailored Engagement
Contact us for a tailored proposal

Turn confirmed CRA findings into implemented controls, tested processes and reviewable closure evidence through targeted senior cybersecurity and product-engineering support.

Best for: teams with confirmed CRA gaps that need senior product-security support to close them.
  • Finding-led cybersecurity requirements and traceability
  • Product security architecture and secure design
  • SBOM, vulnerability management, CVD and PSIRT
  • Article 14 workflow implementation and exercises
  • Risk assessment and threat-modelling support
  • Verification, technical evidence and documentation
  • Product-family and change-impact support
  • Each work package ends with defined closure evidence
Request CRA Gap Closure Proposal
Scope assumptions for fixed-price services. Starting prices assume one defined product family, one legal entity, standard evidence access and the stated workshop/review scope. Complex variants, multiple products, deep technical testing, source-code review, legal analysis and third-party conformity-assessment support are scoped separately.
100% Snapshot credit. The agreed Snapshot fee excl. VAT can be credited toward one CRA Evidence Readiness Assessment for the same business when the remaining assessment balance is paid within 30 calendar days after full Snapshot payment. Subject to applicable terms.
After the assessment. Fortis can support conformity-evidence preparation, pre-submission review and technical interface support where third-party conformity assessment applies. Fortis does not certify products or act as a notified body. Customers with an established baseline can also use Continuous CRA Readiness support for evidence maintenance, component/vulnerability follow-up, regulatory change and periodic readiness review.

Why a questionnaire isn't enough

A checklist records what a company says exists. Fortis examines the distance between a claim and the evidence that actually supports it — across five stages of maturity for every applicable requirement.

  1. 01ClaimedStated as in place
  2. 02DocumentedWritten and traceable
  3. 03ImplementedActually built into the product
  4. 04VerifiedChecked, not assumed
  5. 05Evidence-ReadyDefensible to a third party
Each requirement in an assessment is placed on this progression — not scored as a single pass/fail.

The Fortis CRA Evidence Chain™

For each applicable requirement, Fortis traces the link from regulation to accountability. A broken link at any point becomes a specific finding with a corrective action and expected closure evidence.

  1. 01CRA requirement
  2. 02Product risk
  3. 03Cybersecurity requirement
  4. 04Architecture / implementation
  5. 05Verification
  6. 06Evidence artifact
  7. 07Lifecycle owner
Traceability from regulatory requirement to the named role accountable for it over the product lifecycle.
Illustrative example — not an actual finding
Cybersecurity requirementNo verification evidenceEvidence artifact

A missing link at any stage interrupts traceability — this is how a Fortis assessment records that as a specific, actionable finding rather than a generic score.

Where Fortis Supports the Chain

Support can focus on one workstream or span the full chain, depending on where your organisation needs the most help.

01

CRA Applicability & Scope Support

Support the review of product scope, organizational roles and CRA requirements potentially relevant to the product portfolio and position in the supply chain.

02

Cybersecurity Risk Management

Review how cybersecurity risks are identified, assessed, translated into requirements and managed throughout the product lifecycle.

03

Vulnerability Handling

Review vulnerability intake, triage, remediation, disclosure, monitoring and supporting evidence across products, suppliers and internal engineering organizations.

04

Reporting Readiness

Help establish detection, assessment, escalation, ownership and reporting workflows before a potentially reportable vulnerability or incident occurs.

05

Technical Documentation

Support the structuring and review of cybersecurity documentation and technical evidence used to demonstrate implemented engineering and operational activities.

06

Supplier Interfaces

Support clarification of supplier responsibilities, cybersecurity evidence expectations, vulnerability information flows and escalation interfaces.

What the Evidence Readiness Assessment produces

Each applicable requirement is recorded against a consistent structure, so findings are specific and actionable rather than a general readiness label.

Illustrative record structure — not an actual assessment result
Applicable requirement
Example structure only
CRA reference
Exact clause cited
Customer evidence
What was reviewed
Evidence maturity
Claimed → Evidence-ready
Engineering gap
What is technically missing
Documentation gap
What is not yet written
Corrective action
Required next step
Suggested method/tool
How to close it
Expected closure evidence
What "done" looks like
Responsible role
Who owns it
Priority
P0 / P1 / lower
Fortis support
Where help is available

CRA Readiness %

Proportion of applicable requirements with adequate implementation.

Evidence Confidence %

How well implementation is actually supported by verifiable evidence.

Article 14 Operational Readiness %

Whether reporting workflows would function under real time pressure.

Conformity Route Status

Current view of the applicable conformity-route candidate.

Assessment Coverage %

A limitation/assurance indicator of what the assessment actually reviewed — not a compliance score.

Conceptual output types shown — not a live result or customer score

CRA Article 14 Operational Readiness Sprint

Reporting readiness depends on more than knowing a deadline. Detection, assessment, ownership, escalation, decision-making and reporting interfaces need to be connected so potentially relevant vulnerabilities and incidents can be handled reliably in practice.

Before you can report, you have to know.

This Fortis Lumen briefing illustrates the connection between product scope, cybersecurity activities, vulnerability handling, operational escalation and reporting readiness.

A structured path from uncertainty to sustained readiness

The engagement is adapted to the organization, product portfolio, existing cybersecurity processes and the scope of support required.

1
ClarifyScope, product boundary, role and route
2
AssessRequirement and evidence chain
3
CloseEngineering, process and evidence gaps
4
DemonstrateVerification and conformity evidence readiness
5
MaintainLifecycle and continuous readiness

CRA Frequently Asked Questions

What is the Cyber Resilience Act?

The Cyber Resilience Act is an EU regulatory framework establishing cybersecurity requirements for products with digital elements. The specific obligations applicable to an organization depend on factors including its economic-operator role, product scope and applicable product classification.

How do we know whether CRA requirements are relevant to our product?

Applicability should be evaluated against the specific product, its digital functionality, how it is placed on the EU market and the organization's role in the supply chain. Fortis Lumen can support this analysis, while formal regulatory and conformity decisions remain with the responsible organization.

What does Article 14 reporting readiness involve?

Operational readiness includes the ability to detect relevant vulnerabilities or incidents, assess available information, establish ownership, escalate internally and support required reporting processes within applicable regulatory timeframes.

Can Fortis Lumen support only one CRA workstream?

Yes. Support can focus on areas such as vulnerability handling, cybersecurity risk management, supplier interfaces, reporting readiness, technical documentation or another defined cybersecurity workstream.

What is the difference between the Snapshot and Evidence Readiness Assessment?

The Snapshot is a limited management decision product covering scope, product boundary, likely obligations and priorities. It does not provide a clause-by-clause Annex I assessment or readiness percentage. The Evidence Readiness Assessment evaluates applicable requirements and supporting evidence at requirement level, separates CRA Readiness from Evidence Confidence, identifies blockers and defines expected closure evidence for material findings.

Does a CRA readiness assessment guarantee compliance?

No. A readiness assessment provides advisory analysis of the reviewed scope, identifies observations and gaps, and supports prioritization of improvement activities. It does not constitute certification, legal advice or a guarantee of regulatory compliance. Responsibility for conformity and regulatory obligations remains with the responsible economic operator.

Important: Fortis Lumen Advisory provides cybersecurity engineering, readiness, assessment and implementation support. Services are intended to help organizations understand relevant requirements, identify gaps and establish practical processes, engineering activities and supporting evidence. They do not constitute legal advice, certification or a guarantee of CRA compliance. Regulatory accountability, conformity assessment decisions, declarations and final compliance responsibility remain with the applicable economic operator and other responsible parties.

Not sure where to start?

Start with the Free CRA QuickCheck to identify relevant readiness topics and determine an appropriate next step for your organization.

Request Free CRA QuickCheck

Cookies & Privacy

This website uses cookies to ensure you get the best experience on our website.

Decline Confirm