CRA Cybersecurity Risk Assessment - Product Risk Profile Tool

100% Private Assessment

All calculations happen in your browser. No data is transmitted or stored on our servers. Your product information remains completely confidential.

This is not a CRA product classification

This tool assesses your product's cybersecurity risk profile — not its CRA category. CRA product classification (Default, Important Class I/II, Critical) is determined by product type, not by a risk score. Use the Product Checker to determine your CRA classification.

Cybersecurity Risk Assessment

1. Product Context

Describe your product to establish the baseline context for the risk assessment.

CRA Product Category Your product's CRA classification. Not sure? Use the Product Checker

Product Type The general category of your product with digital elements.

Deployment Environment Where the product is primarily used. Affects the threat landscape and potential impact.

2. Threat & Exposure Profile

These factors determine the cybersecurity threats your product faces and its exposure to attack.

Network Connectivity Determines attack surface size. Public-facing products face the broadest range of threats.

Data Handled The sensitivity of data processed, stored, or transmitted by the product.

Physical Access Risk Whether attackers could physically interact with the device.

Supply Chain Complexity Number of third-party components and dependencies in your product.

Expected Threat Actors Who might target your product? Determines the sophistication of threats to defend against.

3. Current Security Posture

Check what you have already implemented. Unchecked items will be flagged as compliance gaps, prioritised by your risk profile.

Annex I Part I — Essential Cybersecurity Requirements

Secure by default configuration Product is delivered with secure settings out of the box — Annex I Part I (1)(a)

Protection against unauthorised access Authentication, authorisation, and access control mechanisms — Annex I Part I (1)(b)

Confidentiality of data Encryption of data at rest and in transit — Annex I Part I (1)(c)

Integrity of data and software Protection against unauthorised modification of data and code — Annex I Part I (1)(d)

Minimised attack surface Only necessary ports, interfaces, and services are enabled — Annex I Part I (1)(f)

Impact mitigation of security incidents Mechanisms to limit the impact of successful attacks — Annex I Part I (1)(g)

Security event logging and monitoring Recording and monitoring of security-relevant events — Annex I Part I (1)(h)

Annex I Part II — Vulnerability Handling Requirements

Vulnerability identification and documentation Systematic process to identify and document vulnerabilities — Annex I Part II (1)

Coordinated vulnerability disclosure process Policy and process for receiving and handling vulnerability reports — Annex I Part II (5), Art. 13(6)

Security update mechanism Ability to distribute and apply security patches — Annex I Part II (2)

Software Bill of Materials (SBOM) Documented inventory of all components and dependencies — Art. 13, Annex I Part II (1), Annex VII

CRA

NIS2

GDPR

DSA

AI Act

Available Now

In Development

Get notified when new content is ready

Menu

Cybersecurity Risk Assessment

100% Private Assessment

This is not a CRA product classification

Cybersecurity Risk Assessment

1. Product Context

2. Threat & Exposure Profile

3. Current Security Posture

Annex I Part I — Essential Cybersecurity Requirements

Annex I Part II — Vulnerability Handling Requirements

Cybersecurity Risk Profile

Risk Area Breakdown

Priority Annex I Requirements

Compliance Gaps

Next Steps

🤝 Still Feeling Overwhelmed by CRA?