Guides · Tools · Crosswalk · Consultancy
Free guides and tools for the Cyber Resilience Act, the Machinery Regulation, the Radio Equipment Directive, NIS2 and the GDPR: who they apply to, what they ask and by when. When the work starts: Crosswalk for your compliance file, and advice from Depre.nl.
No account needed · Law texts from EUR-Lex
What you find here
Start free with the guides and the tools. When the work begins, keep your compliance file in Crosswalk, or ask us to help.
In plain English for the CRA, the Machinery Regulation, NIS2 and the GDPR: who each law applies to, what it asks, the deadlines and the penalties. For the CRA, the Machinery Regulation, the Radio Equipment Directive, NIS2 and the GDPR also the law text, article by article.
First the 2-minute scan of which laws apply, then the tool for your law where there is one. In your browser, no account.
A workspace for your compliance file under the CRA, the Machinery Regulation, RED, NIS2 and the GDPR: gaps, actions and the evidence a customer, notified body or regulator asks for. It runs in your browser; the Lite licence is free.
Training (through Mikrocentrum), guidance on assessments and support while you implement, from Depre.nl, the company behind this site.
The clock is running
Five laws, one calendar. Some dates have passed; the rest are close enough to plan for now.
Cybersecurity requirements for radio equipment apply
REDRules for notified bodies apply
CRAReporting of actively exploited vulnerabilities and severe incidents
CRAMachinery Regulation applies
MRAll CRA obligations apply
CRATools
Everything here is free and runs in your browser. The scan tells you which laws apply; the hubs and tools take you from there.
A few questions about where you operate, what you make and whom you serve. You get a yes or no per law, the reasoning, and the tools that fit.
For anyone placing products with digital elements on the EU market: obligations, requirements, the timeline, penalties and the free CRA tools.
For essential and important entities: risk-management measures, incident reporting, governance, and whether your sector is in scope.
Is your product in scope, what is your role, and in which class?
The obligations as a printable list.
Who does what, as a printable matrix.
Your role, your machine, your rights and obligations.
Regulation (EU) 2023/1230, applies from 20 January 2027: overview, articles, obligations, six steps to conformity, timeline.
Essential, important, or out of scope.
Lawful processing, security of processing, breach notification.
Crosswalk · one assessment, five laws
Overlapping obligations are mapped to each other, and the standards you already use to every law they serve, so a requirement you answer under the CRA also counts under NIS2 and the GDPR where they overlap, and a standard assessed once counts for every law it supports.
Hover or focus a law to see which standards Crosswalk assesses it against. Standards stay voluntary; the law is the binder.
Home shows the four stages in the order you work in, each with its state, and the one next step. Figures has the numbers behind it.
A requirement counts as in place once its evidence is recorded; what is missing becomes an action with an owner and a date.
The audit report set: a management review, one document per law and the technical documentation in the order Annex VII prescribes, as Markdown or PDF.
Crosswalk is itself a product with digital elements, and we keep its compliance file in Crosswalk.
Built on proven standards
Each law has its frameworks: ENISA guidance and IEC 62443 for the CRA, ISO/TR 22100-4 and IEC TS 63074 for the Machinery Regulation, ISO 27001 for NIS2, ISO 27701 for the GDPR. The site shows where they overlap, so one investment serves several laws.
Who builds this
Software security and compliance specialist with more than thirty years in OT software development: factory automation, control algorithms, test frameworks and automated generation of compliance evidence, with secure product development under IEC 62443-4-1 and 4-2 in industrial control. He developed and teaches the four-day Cyber Resilience Act course at Mikrocentrum and speaks on security in OT. Before that: thirteen years of OPC and RFID courses for Mikrocentrum.
The scan tells you in two minutes which EU cyber laws apply to you and which tools fit. For what a scan cannot answer, talk to us.
