EU Cyber Resilience Act — Product Compliance Assessment

Overview

While the CRA Organisational Readiness Assessment evaluates whether your organisation is prepared for the Cyber Resilience Act, this companion tool goes product by product — assessing each product with digital elements against the CRA's essential cybersecurity requirements at the individual product level.

The assessment covers 126 questions across 9 compliance domains, evaluating everything from how a product is classified under the CRA through to its technical security properties, vulnerability handling processes, and conformity assessment readiness. Each question is mapped to specific CRA articles and annexes, with guidance on what evidence is expected.

Products can be assessed individually or managed as a portfolio, giving you a consolidated view of CRA compliance across all your products with digital elements. The portfolio view highlights common gaps, generates cross-product heatmaps, and produces board-ready compliance reports covering your entire product range.

Multi-Product Portfolio Assessment

Unlike single-product tools, this assessment is built for organisations with multiple products. You can:

• Add and assess multiple products within a single assessment instance
• Classify each product independently — Default, Important Class I (Annex III), Important Class II (Annex III), or Critical (Annex IV)
• View a portfolio dashboard with compliance scores, heatmaps and domain breakdowns across all products
• Identify common gaps that affect multiple products — so you can fix systemic issues once rather than product by product
• Generate portfolio-level Word and Excel reports alongside individual product reports

Product Classification

The CRA requires different conformity assessment pathways depending on product classification. The assessment includes an interactive classification module that helps you determine the correct category for each product:

• Default — General products with digital elements. Self-assessment permitted under harmonised standards.
• Important — Class I (Annex III) — Products such as identity management systems, browsers, password managers, VPNs, network management systems, SIEM, firewalls for non-industrial use, routers and modems. May use harmonised standards for self-assessment.
• Important — Class II (Annex III) — Products such as operating systems, hypervisors, container runtimes, PKI systems, CPUs with security features, industrial firewalls and IDS. Third-party conformity assessment required.
• Critical (Annex IV) — Highest-risk products requiring mandatory third-party assessment by a notified body.

Assessment Domains

Each product is evaluated across 9 CRA compliance domains:

• Product Classification (12 questions) — Determining the correct CRA product classification and conformity assessment pathway
• Security by Design (18 questions) — Embedding cybersecurity into the product design and development lifecycle
• Technical Security Properties (20 questions) — Implementing technical controls for confidentiality, integrity and availability
• Vulnerability Handling (17 questions) — Identifying, disclosing and remediating product vulnerabilities
• Incident Reporting & Response (10 questions) — Detecting, reporting and responding to security incidents
• Technical Documentation (15 questions) — Maintaining technical documentation required under Annex VII
• Conformity Assessment Readiness (11 questions) — Preparing for and completing the conformity assessment procedure
• User Information & Instructions (12 questions) — Providing users with security information and secure usage guidance
• Supply Chain & Components (11 questions) — Managing third-party component security and supply chain risks

Evidence & Documentation

Each question supports evidence attachment — upload supporting documents, policies, screenshots and test results directly against the relevant question. The assessment maintains a complete evidence register that can be exported as a packaged archive, making it straightforward to compile the documentation needed for conformity assessment or audit preparation.

Assessors can also add notes and justifications for any questions marked as not applicable, creating a complete record of assessment decisions.

Reporting

The assessment generates comprehensive reports at both the individual product and portfolio levels:

• Product Word Report — Executive summary, domain compliance scores, gap register with CRA article references, prioritised remediation plan, evidence register, N/A exclusions, and full response record
• Product Excel Workbook — Detailed compliance data for tracking, filtering and analysis
• Portfolio Word Report — Cross-product executive summary, compliance heatmap, common gaps analysis, product-by-product domain scores, and portfolio-wide recommendations
• Portfolio Excel Workbook — Consolidated data across all assessed products
• Evidence Package — Downloadable archive of all attached evidence files organised by question reference

Who It's For

This assessment is designed for:

• Manufacturers needing to assess individual products against CRA essential requirements
• Product security teams responsible for multiple products with digital elements
• Organisations preparing products for CRA conformity assessment
• Teams needing to classify products against CRA Annex III and Annex IV categories
• Compliance teams requiring portfolio-level visibility across a product range
• Organisations compiling evidence and documentation for notified body engagement