100% In-Browser & Private

Cyber Resilience Act (CRA) Assessment & Certificate Generator

EU Cyber Resilience Act (CRA 2024/2847) Conformity Self-Assessment

Evaluate digital products, software architectures, vulnerability handling processes, and SBOM transparency under Regulation (EU) 2024/2847 (Cyber Resilience Act). Run an interactive security self-audit, evaluate CSIRT notification readiness, and generate an informational Self-Assessment Readiness Summary.

Self-Assessment & Educational Tool Notice: This interactive assessment is designed solely for technical self-evaluation and educational purposes. It does not provide legal advice, does not replace formal third-party conformity assessment, and does not grant official CE marking certification under EU law.

Manufacturer & Digital Product Parameters

--%
Pending Assessment (10 Requirements)

CRA Conformity Readiness Self-Assessment

Please select a conformity status for all 10 Essential Cybersecurity Requirements below to calculate your readiness score.

EU Cyber Resilience Act Statutory Exposure: Pending Assessment (Select All Requirements)
Max Statutory Penalty: Up to €15,000,000 or 2.5% of worldwide annual turnover (Article 53)

10 Essential Requirements of Regulation (EU) 2024/2847

01

Annex I, Part I (1): Security-by-Design & Secure Default Configuration

Please Select

Product delivered without exploitable vulnerabilities; sensitive computations executed in secure local sandboxes (e.g. Client-Side Web APIs).

02

Annex I, Part I (2): Protection Against Unauthorized Access

Please Select

Robust access management, least-privilege architecture, and isolation of sensitive runtime memory from untrusted third-party code.

03

Annex I, Part I (3): Confidentiality & Integrity Protection (TLS 1.3)

Please Select

Enforcement of modern cryptographic standards in transit and at rest with strict HSTS, Content Security Policy, and nosniff directives.

04

Annex I, Part II (1): Software Bill of Materials (SBOM)

Please Select

Machine-readable dependency inventory documenting software components, versions, origins, and licenses without unverified runtime bundles.

05

Annex I, Part II (2): RFC 9116 Coordinated Vulnerability Contact

Please Select

Publicly discoverable /.well-known/security.txt with contact email, expiration date, policy link, and safe harbor commitment.

06

Annex I, Part II (3): Vulnerability Handling & Remediation SLA

Please Select

Documented vulnerability handling policy with 24-48h triage and mandatory patch deployment SLAs (critical fixes within 7 days).

07

Article 11(1): 24-Hour Early Warning to ENISA & CSIRTs

Please Select

Operating procedures established for early warning notification of actively exploited vulnerabilities to ENISA and designated CSIRTs within 24 hours.

08

Article 11(2): 72-Hour Severe Incident Notification

Please Select

Operational readiness to submit comprehensive incident notification to competent CSIRTs and affected users within 72 hours of incident confirmation.

09

Articles 13 & 14: CE Marking & EU Declaration of Conformity

Please Select

Technical documentation compiled to substantiate CE marking and support market surveillance authorities under EU harmonization legislation.

10

Article 53: Penalty Risk Mitigation & Supply Chain Due Diligence

Please Select

Mitigation of maximum statutory sanctions (€15M / 2.5% global turnover) through verifiable supply chain security controls and continuous maintenance.