Crosswalk is not available in your region: this connection appears to come from an excluded country. The United States and countries subject to comprehensive EU sanctions are excluded. Using a VPN or a privacy proxy? Then this notice can be wrong; the check runs in your browser and nothing is stored. You are welcome to read on - details.
What it does
Every picture below is the real application, in two example projects that ship with it: an invented machine builder and our own compliance file.
Try the example Claim your free Lite licence
Lite is free. Renews every year at no cost. Essentials €99 a month, excl. VAT. See plans
Home and scope
Set up · Assess · Fix · Prove
Incident
Reference
Every change is recorded on every plan, in a chain whose integrity can be checked. The Logbook page: from the Essentials plan.
No sign-up
Try the example Claim your free Lite licence
Nothing to install, no sign-up, no payment details.
Reference
| What | Plan |
|---|---|
| Incident cases, with their decision trail | On every plan |
| The Logbook, kept and exported as CSV or JSON | On every plan |
| The Logbook page, with its filters and the chain check | From the Essentials plan |
| Attaching evidence files, and the evidence binder | From the Essentials plan |
| The disclosure policy and security.txt | From the Essentials plan |
| The AI assistant's interview, opt-in | On a paid plan |
| Supplier due diligence | On the Professional plan |
| The compliance calendar, exported as .ics | On the Professional plan |
Home shows the stages as a row of steps with their state and says what still keeps Prove from done. Under Incident it names a running reporting clock or a case still waiting for its triage.
The scope control sits at the top of the sidebar, in the address, and as the scope filter of the compliance calendar, the Logbook and Figures; the Work queue lists the sidebar's scope. Its panel lists the organisation and every product with their requirements in place and open actions; type to find a product.
Tick the laws that apply: the CRA, NIS2, GDPR, the Machinery Regulation and RED. The standards follow per law, and a product can say what it is, so the RED sections disappear for a product that is not radio equipment.
Our scope and roles is the record behind everything else: the laws and standards you are measured against, your role in the supply chain, each product's class and support period, and the requirements you set aside with how many of them carry a written reason. Each line says what it changes, when it was recorded and which page it is made on.
The Products page lists every product with where it stands in each stage. Search it, sort any column, and open a product or one of its stages.
The organisation and each product have their own checklists, the laws first and then the standards, each with its requirements in place out of those that apply. A requirement counts as in place when its evidence is recorded too.
How mature are we reads the same answers as a maturity picture, and the risk analysis holds the risk register, a threat model per product and supplier due diligence. On a paid plan the AI assistant can interview you and fill a section in from your answers, for you to accept. AI is opt-in.
The Work queue lists the actions of the scope chosen in the sidebar, your own first, with one switch to everyone's and one search over the action, its requirement, its checklist and law, and who holds it. Tick an action off there, open it to read or edit it, or go to its requirement; done actions fold away under the list.
The link beside the Work queue's title lists the requirements that are not in place yet, by area or by severity. Click one and its checklist opens at that requirement.
Prove lists what the organisation and each product hand over: the audit report set, a document per law, the technical file, the EU declaration of conformity and the security datasheet. Each document keeps the date it was generated, and one that is out of date says what changed since.
Prove is done when every document is generated and up to date and every product that needs one has an issued declaration. The disclosure policy can be copied or downloaded as Markdown.
The Incident page of the organisation and of each product starts with what needs attention: the open cases, red while a triage waits or a reporting clock runs. Something happened opens the situations: someone reported a vulnerability, an incident happened, a component has a known vulnerability, you need to warn your users; then the planned work, a change to the product or a release. Below them, what is due in the next 90 days and the open work.
A case opens on its receipt, the report as it came in. The becoming-aware triage asks one question at a time, and an answer waits for the evidence it rests on. The staged reporting duties then appear per regime with their deadlines, the CRA's 24 hour early warning among them, and the decision trail stays with the case.
In Chrome and Edge your projects can be plain files in a folder you choose, and they stay readable and exportable whatever happens to the subscription.
The Lite licence covers all five laws, to find out where you stand inside your organisation. Free. Renews every year at no cost. What it makes carries the Lite watermark and a small “Made with Crosswalk Lite” credit. Paid plans, for the proof you hand over, from €99 per licence per month.
Two things that used to sit in the application are reading material, so they live on this site: where the five laws ask for the same thing, and the harmonised standards requested for the CRA with their state of play. In the application, Reference holds the Logbook, the glossary and the mapping of the CRA to IEC 62443.
| Document | Pages |
|---|---|
| CRA product audit | 42 |
| CRA technical file | 8 |
| CRA organisation audit | 30 |
| NIS2 dossier | 8 |
| Management review | 6 |