CRA readiness self-check

A short self-assessment against the Cyber Resilience Act Annex I categories. Informational only, not a conformity assessment.

We can produce a software bill of materials (SBOM) for this product.
The product ships with a secure default configuration, not open/debug defaults.
We have a way to deliver security updates to devices already in the field.
We have a published vulnerability disclosure policy and a security.txt file.
We have a process to report an actively exploited vulnerability within 24 hours.
We have a documented cybersecurity risk assessment for this product.
We have reviewed and minimised the network services and ports exposed by default.
We have declared a support period for this product and communicated it to users.

0 of 8 checked

Guides for the unchecked items:

/guides/firmware-sbom/
/guides/cra-annex-i-explained/
/guides/cra-checklist-device-makers/
/guides/vulnerability-disclosure-policy-template/
/guides/cra-vulnerability-reporting-24h/

This self-check is informational only, not legal advice and not a certification. It covers only the items above, not the full Cyber Resilience Act. Your answers stay in your browser.