Cyber Resilience Act (CRA)

The Cyber Resilience Act (Regulation (EU) 2024/2847) applies to manufacturers of products with digital elements. The reporting obligations have applied since 11 September 2026: for actively exploited vulnerabilities and severe security incidents, an early warning is due within 24 hours and the notification within 72 hours, each from the time of becoming aware. The remaining obligations apply from 11 December 2027, including risk assessment, the software bill of materials (SBOM) and technical documentation.

Under the heading CRA-compliant process consulting, I develop and adapt development processes so that these obligations are met in everyday practice: reporting, vulnerability handling and evidence become part of ongoing development—not a side project. The process builds on your existing development; I do not rebuild what already works.

Recommended CRA packages

Four main packages form the recommended ladder (not mandatory): Orientation → Gap / current-state assessment → CRA Coaching → CRA-compliant development. Package 3 “CRA Coaching” is a step of its own. Package 4 “CRA-compliant development” is the core product and includes CRA coaching. You can commission each building block separately. Optional and separately bookable alongside: Introduction and Evidence review; they can feed into Gap or CRA Coaching.

Orientation

Goal: Clarify where the manufacturer stands and which next building block fits.

Approach: Remote, short. Recommended entry on the ladder; skippable if you are already sufficiently informed.

Outcome: Shared understanding of the situation and a recommendation for the next step.

Gap / current-state assessment

Goal: Check where the current state already covers CRA obligations and where the gaps are.

Approach: I capture the current state with a traffic-light view and measures—the basis for CRA Coaching or CRA-compliant development.

Outcome: Traffic-light picture and a prioritized list of measures.

CRA Coaching

Goal: Close gap items step by step—a coaching step of its own on the ladder.

Approach: I accompany the gap and the measures until all gaps are closed and settled. A standalone package, separate from Package 4 “CRA-compliant development”.

Outcome: Updated traffic lights and documented progress.

CRA-compliant development

Goal: Build or adapt a lean development process for systems and software.

Approach: Risk assessment, SBOM generation in the build, configuration and release management, vulnerability handling, and the reporting process—built on top of your existing development. CRA coaching is part of this package.

Outcome: A lived, evidence-ready process in the team.

We work on interim assignments: I build or adapt the CRA processes for a defined period in your team, then hand the process over to the people responsible in the company. The interim mandate ends with a documented handover so the process keeps running without external support.

Funding

For small and medium-sized enterprises, CRA-compliant development can be co-funded through the EU program SECURE (Cascade Funding / Second Open Call) (50%, up to €30,000; application deadline of the current call: 11 December 2026). The company files the application; I support the preparation of the project proposal.

Optional packages

Introduction and Evidence review are optional and can be booked on their own. They can feed into Gap / current-state assessment or CRA Coaching.

Introduction

Goal: Check whether the reporting chain holds when it counts.

Together with your team, I walk through a fictitious case tailored to your product—from a customer’s first report through to the early warning and the 72-hour notification.

Among other things, we check:

• who assesses whether an event is reportable, and who clears the report—weekends included,
• whether access to the reporting platform is in place,
• whether it is possible to establish which products and software versions are affected and to which countries they were shipped,
• whether a template for informing users exists.

The Introduction usually takes one day. The outcome is a short report of the gaps found and the measures that close them.

Evidence review (sample on one product)

Goal: Show where the evidence already holds today and where the gaps are.

For one selected product, I follow a chain: from a risk through the security requirement, the design, and the test to user information. The basis is your documents and conversations with your team; we do not need access to your systems. The outcome is a list of gaps with measures and priorities.

The review is a technical stocktake. It is not a conformity assessment and not a confirmation that requirements are met.

Scope

Our support covers technology, processes and evidence. It does not include legal advice.

Background

These topics are covered in more depth in an article series on projectcrunch.de (German):

• Cyber Resilience Act: Was auf Hersteller zukommt (German)
• CRA-Meldepflicht: Das Timing ist kritisch (German)
• Cyber Resilience Act: Das Risiko trägt der Hersteller (German)

Contact

A first conversation is free of charge and non-binding. Please write to info_at_unitedmentors.com with the subject “CRA” and a short description of your product. We reply within one business day to arrange a time.