Free self-assessment · 60 minutes · EU CRA
How ready is your product for the Cyber Resilience Act?
The Cyber Resilience Act applies to products with digital elements from December 2027. It is not a policy exercise: it reaches into how you design, document, patch and retire the thing you sell. This measures how close your current practice is, across twenty-five questions and five areas.
Who it is for
You manufacture, import or distribute a product with digital elements — connected hardware, or software you sell as a product. If you work with somebody else’s product instead, as an integrator, reseller, operator or service provider, the Product Security Readiness Check is the shorter and more relevant one.
What it covers — five areas, five questions each
- Governance and documentation
- Risk management and security by design and by default
- Vulnerability and patch management
- Product life cycle management
- Awareness, competence and skills
Unlike the other assessments this one scores maturity rather than a percentage, using the model ENISA publishes for smaller manufacturers. Maturity is the right shape here because the CRA is not a checklist you pass — it is a set of practices you have to be able to demonstrate, repeatedly, over a product’s life.
What you get
A seven-page PDF. A maturity level per area, a radar chart across the five, and then the part that does the work: a page headed “Where you stand” that opens with what your level actually means — at this level, cybersecurity is mostly informal and reactive — and follows it with concrete next steps grouped under each of the five areas. Establish a contact point for vulnerability reports. Research an SBOM strategy. Make support periods clear to customers. Roughly twenty of them, ordered so you can start where your scores are lowest.
There is no severity-ranked list of findings here, and that is not a shortfall: on the maturity scale “Where you stand” takes its place, and of the two it is the more useful page. Every question and your answer is listed at the end.
What the report looks like
Three pages from a real report, generated by running the assessment.
How you scored 
Where you stand 
Your answers
An honest note on timing
December 2027 sounds distant. The reporting obligations arrive sooner, and the work that takes longest — an SBOM you actually maintain, a vulnerability handling process with someone answering it, support periods decided and published — is measured in quarters, not weeks.
The assessment starts below — you do not need to go anywhere else.
A few details first
We use these to prepare your report and, if you would like, to talk it through afterwards.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
If you place a product with digital elements on the EU market, almost certainly. The harder questions are which class it falls into and which obligations follow, and those deserve an hour of somebody's attention rather than a guess. This assessment does not answer them — it tells you how far your current practice is from what any class will require.
This page is, and the questionnaire is not — the twenty-five questions and the report are English for now. We would rather publish it than hold it back for a translation. If English is a barrier for the people who would answer it, say so when you book the conversation and we will walk it through with you.
For manufacturers, no — twenty-five questions is already the short form of a long regulation, and most of the hour goes on checking what actually happens rather than on reading. If you are not the manufacturer, the Product Security Readiness Check is seventeen questions and the right one for you.
It helps and it does not substitute. Those describe how an organisation or a system is secured; the CRA asks what you can demonstrate about a product across its life — an SBOM, a vulnerability contact, a published support period, evidence of secure defaults. The assessment shows which of those you can already evidence.
It does not classify your product, produce technical documentation, or stand in for a conformity assessment. It tells you where the distance is, in enough detail to plan. Anyone offering you CRA compliance from a questionnaire is selling you something that does not exist.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.