CRA Compliance Checklist

Your complete guide to achieving Cyber Resilience Act compliance. Track your progress through all essential requirements.

Your Progress

Track your compliance journey

0 of 0 completed

Planning & Assessment Phase

Determine CRA Applicability

Assess if your product falls under CRA scope (products with digital elements)

Identify Product Category

Determine product category: Default, Important (Annex III), or Critical (Annex IV)

Conduct Gap Analysis

Compare current security practices with CRA requirements

Create Compliance Roadmap

Develop timeline and resource allocation plan

Assign Responsibilities

Designate team members for compliance activities

Security by Design Requirements

Implement Secure Development Lifecycle

Integrate security at every stage of product development

Default Security Settings

Ensure products are secure by default upon installation

Data Protection Measures

Implement encryption for data at rest and in transit

Access Control Implementation

Establish authentication and authorization mechanisms

Input Validation

Implement comprehensive input validation and sanitization

Minimize Attack Surface

Remove unnecessary features, ports, and services

Risk Assessment & Management

Conduct Risk Assessment

Identify and document cybersecurity risks

Risk Mitigation Plan

Develop strategies to address identified risks

Third-Party Risk Assessment

Evaluate risks from components and dependencies

Supply Chain Security

Assess and secure the software supply chain

Regular Risk Reviews

Establish process for periodic risk reassessment

Vulnerability & Update Management

Vulnerability Disclosure Process

Establish coordinated vulnerability disclosure policy

Security Update Mechanism

Implement secure automatic update capabilities

Support Period Commitment

Define support period proportionate to expected product lifetime (at least 5 years)

Vulnerability Monitoring

Continuously monitor for new vulnerabilities

Incident Response Plan

Create and test incident response procedures

SBOM Management

Maintain Software Bill of Materials

Testing & Validation

Security Testing

Conduct comprehensive security testing

Penetration Testing

Perform penetration testing for critical products

Code Review

Conduct security-focused code reviews

Automated Security Scanning

Implement SAST/DAST in CI/CD pipeline

Compliance Validation

Verify all CRA requirements are met

Documentation & Declaration

Technical Documentation

Prepare comprehensive technical documentation

EU Declaration of Conformity

Draft conformity declaration document

User Documentation

Create security guidance for end users

Risk Assessment Documentation

Document all risk assessments and mitigations

Change Management Records

Maintain records of security-relevant changes

Conformity Assessment & CE Marking

Choose Conformity Assessment Procedure

Select appropriate module (self-assessment or third-party)

Notified Body Engagement

Engage notified body for critical products (if applicable)

Complete Assessment Process

Undergo conformity assessment procedures

Affix CE Marking

Apply CE marking to product and packaging

Complete required registrations and notifications

Ongoing Compliance & Monitoring

Continuous Monitoring

Monitor for new vulnerabilities and threats

Regular Security Updates

Release security patches as needed

Compliance Audits

Conduct periodic compliance reviews

Documentation Updates

Keep all documentation current

Training & Awareness

Maintain team competency on CRA requirements

Export Your Checklist

Need Help?

This checklist covers the essential CRA requirements. For detailed guidance:

View Complete Compliance Guide →

CRA

NIS2

GDPR

DSA

AI Act

Available Now

In Development

Get notified when new content is ready

Menu