Preparing Your Organization for the CRA

Your 12-Month CRA Action Plan

Here’s a step-by-step plan to achieve CRA compliance before the December 2027 deadline.

Month 1-2: Assessment Phase

Product Inventory

For each product, document:
- [ ] Product name and version
- [ ] CRA classification (Default/Class I/Class II/Critical)
- [ ] Applicable ETSI standards
- [ ] Current security posture
- [ ] Gap analysis vs CRA requirements

Stakeholder Alignment

Brief executive leadership on CRA obligations
Assign CRA compliance ownership (CISO, VP Engineering, or dedicated role)
Budget allocation for compliance activities

Month 3-4: Foundation Building

SBOM Pipeline

Implement SBOM generation in CI/CD
Choose format (CycloneDX recommended)
Automate vulnerability scanning against SBOM
Set up dependency monitoring

Vulnerability Handling

Create or update security.txt
Establish coordinated vulnerability disclosure policy
Set up incident response procedures
Define ENISA reporting workflow

Month 5-8: Implementation

Security Engineering

Conduct threat modeling for each product
Implement security testing in CI/CD (SAST, DAST, fuzzing)
Review and harden security defaults
Ensure secure update mechanisms

Documentation

Begin technical documentation
Document security architecture
Record security design decisions
Prepare conformity assessment evidence

Month 9-10: Testing and Validation

Conformity Assessment

Self-assessment for Default/Class I products
Engage third-party assessor for Class II/Critical
Conduct penetration testing
Validate SBOM completeness

Process Verification

Test vulnerability reporting workflow end-to-end
Verify 24-hour ENISA reporting capability
Test security update delivery mechanism
Conduct tabletop exercise for incident response

Month 11-12: Launch

Go-Live

Publish EU Declaration of Conformity
Apply CE marking
Publish security update policy
Announce CRA compliance to customers

Ongoing

Continuous vulnerability monitoring
Regular security testing
Periodic SBOM updates
Maintain technical documentation

Key Success Factors

Executive sponsorship — CRA compliance needs budget and authority
Cross-functional team — engineering, security, legal, and product
Start early — 12 months is tight for complex products
Automate everything — manual compliance doesn’t scale
Document as you go — don’t leave documentation for the end

Need help building your CRA compliance roadmap? I help organizations plan and execute cybersecurity regulation compliance. Get in touch.