In short
Checks a product against 8 CRA Annex I categories
You need to know where one product stands on each item
You get a score, the gaps in suggested order and a text summary
Runs in your browser; answers are not stored or sent
Who uses it
Device makers and brands
The head of product sees which Annex I items still need work before the CRA deadlines.
Machine builders and automation OEMs
The CE and compliance lead checks a machine line with digital elements against the same 8 items.
Product security and PSIRT owners
The PSIRT lead confirms the 24-hour reporting and disclosure items have an owner.
How it works
The 8 items below are drawn from Annex I of Regulation (EU) 2024/2847, the Cyber Resilience Act, whose obligations phase in on the timeline the European Commission's own CRA policy page sets out: reporting duties from 11 September 2026, full applicability from 11 December 2027. For the full set of CRA obligations beyond these 8 items — scope, roles, product classes and fines — see our Cyber Resilience Act requirements guide. The 24-hour exploited-vulnerability item below is filed, once it applies, through ENISA's CRA Single Reporting Platform.
This self-check is informational only, not legal advice and not a certification. It covers only the items above, not the full Cyber Resilience Act. Your answers stay in your browser.
Tick what is in placeGo through the 8 statements and tick each one that is true for this product today. Read the resultThe score shows how many categories are covered. Open gaps are ranked by deadline and typical lead time, each with a guide. Keep a copyDownload a plain-text summary of your answers to share with your team.
Why does the CRA treat a vulnerability disclosure channel as a legal requirement, not good practice?
Regulation (EU) 2024/2847, the Cyber Resilience Act sets out its vulnerability-handling obligations in Annex I as essential requirements a product must meet, not as voluntary good practice. That is why this checklist lists "a published vulnerability disclosure policy and security.txt file" as one of its 8 items alongside SBOM availability and secure default configuration — all 8 are drawn from that same Annex I essential-requirements list, per the European Commission's own summary of the Act.
The most time-sensitive consequence of that requirement shows up once the CRA's reporting duties start applying on 11 September 2026: a manufacturer that becomes aware a vulnerability is being actively exploited must notify within 24 hours, filed through ENISA's CRA Single Reporting Platform rather than each national authority separately. A missing disclosure channel is the one gap on this checklist that cannot be fixed in a day once that clock starts — our PSIRT as a service sets up that intake-and-response process, including the 24-hour reporting step, before the clock does.
What you get
5 / 8
Annex I categories checked
Suggested order to close these gaps
- 1. OverdueWe have a process to report an actively exploited vulnerability within 24 hours.
- 2. MediumWe have a documented cybersecurity risk assessment for this product.
- 3. MediumWe have reviewed and minimised the network services and ports exposed by default.
Formats and standards
Standard names belong to their owners and are used only to identify the formats; nominative use, no endorsement implied.
Delivered by Netbase JSC
SoftWSP is a brand of Netbase JSC. Facts of Netbase JSC as of .
Founded
2012
Reach
Clients in around 80 countries
Delivery model
Remote, worldwide
Vulnerability reports
PSIRT via [email protected], published security.txt
The full job, done for you
The self-check shows where the gaps are. Our device firmware security service scans the binary firmware, builds its SBOM, ranks the vulnerabilities to fix first and, where you hold the source code, prepares the fix and proves it with a re-scan.
Need this across a product range or in your pipeline? Talk to sales.
Frequently asked questions
Is this self-check a CRA conformity assessment?
No. It is an informational, self-reported indicator against 8 Annex I-derived categories, not a conformity assessment, legal advice or a certification. A real conformity assessment follows the CRA's own procedure and, for important/critical products, may require a notified body.
What are the 8 items this check covers?
SBOM availability, secure default configuration, a field-update mechanism, a published vulnerability disclosure policy and security.txt file, a 24-hour exploited-vulnerability reporting process, a documented risk assessment, minimised attack surface, and a declared support period — each drawn from the CRA's Annex I essential requirements.
What is the 24-hour reporting obligation?
Under the Cyber Resilience Act, manufacturers must notify an actively exploited vulnerability or a severe incident within 24 hours of becoming aware of it. ENISA operates the CRA Single Reporting Platform manufacturers use to file that notification.
When do CRA obligations actually apply?
The regulation entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026, and the regulation is fully applicable from 11 December 2027 — the dates the European Commission's own summary of the legislative text sets out.
Does the check save or send my answers anywhere?
No. Your checkbox answers stay in your browser for the session; nothing is uploaded. The "Download results" button writes a plain-text summary to a file on your own device.
Related
Sources
Questions about this page?