Guides for buying outside help with the CRA: penetration testing, coordinated vulnerability disclosure and PSIRT setup, harmonized standards, notified bodies and support for SMEs.
What the CRA says about security testing: the regular testing requirement, why it is risk-based rather than a fixed annual test, test types the Commission lists, test reports in the technical documentation, and testing by notified bodies.
How to set up the vulnerability intake and disclosure process the CRA requires: a CVD policy, a contact address and single point of contact, evidence in the technical documentation, upstream reporting and public advisories.
Where the CRA harmonized standards stand and how to work before they are cited: the M/606 deliverables and deadlines, presumption of conformity only after Official Journal publication, common specifications, EUCC certification and the limits of a core-functionality standard.
When a notified body is needed and how to pick one: module B with C versus module H, independence and the NANDO list, the notification milestone, reassessment after substantial modification, fee reductions for SMEs, and published cost estimates.
What relief the CRA gives microenterprises and SMEs: simplified technical documentation, reduced notified body fees, no fines for missing the 24-hour warning, CSIRT helpdesks, national support and sandboxes, and how authorities weigh size in penalties.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.