Cyber Resilience Act compliance cost

What does Cyber Resilience Act compliance cost per product?

The Commission's impact assessment SWD(2022) 282 estimated the average conformity assessment cost per product at EUR 18,400 for self-assessment and EUR 25,000 for third-party assessment, both including one-off and recurrent costs. Those figures were built from secondary data and were made for the 2022 proposal, not for the regulation as adopted, so treat them as a starting reference rather than a budget for your product. If a customer or market surveillance authority is asking for CRA evidence today, the first step is to confirm which route applies to your product, because the cost difference between routes is larger than the difference between estimates. The real figure depends on four things: the product's class under the regulation, the conformity route that class requires, how mature your existing security engineering already is, and how long you must support the product. A default product that can use module A carries very different work from a class II or critical product that needs a notified body under module B with module C or H, which adds periodic audits of your vulnerability handling or quality system. The regulation's route rules also differ from the proposal the 2022 estimates were based on, so ask any vendor or consultant to show which article and annex their quote relies on. Also ask how much of the work is already business as usual for your organization, since the impact assessment treated most of the cost of complex products as already incurred. For the quote itself, ask for the work split by item: the risk assessment, technical documentation, vulnerability handling process, evidence collection, and any notified body fees. Your organization owns its controls and decides the product's compliance position. An implementation partner can prepare systems, documentation and evidence for review, but only an independent notified body or other competent body issues conformity evidence. Confirm that split in writing before work starts, and check the official regulation text for the current article references your quote depends on.

Which costs you pay, who gets paid, and what recurs

This table lists each cost component of CRA compliance, who is paid for it, whether it is one-time or recurring, and what drives it up or down. Read it as a checklist for requesting quotes, and note that the only published figures come from the Commission's 2022 impact assessment and apply to the 2022 proposal, not the adopted regulation.

Cost component	Who is paid or who bears it	One-time or recurring, and main driver
Internal staff time for the risk assessment and technical documentation	Your own engineering, product and compliance staff	One-time to start, then recurring as products change. Driver: number of product families and how often they are substantially modified.
Secure development lifecycle work	Your engineers, plus any tooling or training vendors	Largely one-time, with upkeep. The impact assessment (SWD(2022) 282) cited an academic model adding on average 30.5% to development costs where no comprehensive security measures exist. Driver: current maturity.
Implementation partner scoping and evidence preparation	An implementation partner, under a written fixed scope	One-time for the initial build, with possible retainer support afterwards. Driver: number of products, existing documentation and gaps against Annex I.
Security testing of products	Independent testers or your internal security team	Recurring across the support period. Driver: release frequency and the depth of testing you choose.
Notified body fees for module B, C or H routes	The notified body, which must reduce fees proportionately for microenterprises and SMEs under Article 32(6)	One-time assessment, plus periodic audits under module B or H (Annex VIII). Driver: product class and whether harmonized standards are fully applied.
Conformity assessment under module A	Internal staff only, since the manufacturer self-assesses for most products	One-time per product. The impact assessment estimated an average of EUR 18,400 per product for self-assessment, including one-off and recurrent costs (SWD(2022) 282).
Third-party assessment, where required	Notified body or certification scheme body	One-time per product. The impact assessment estimated an average of EUR 25,000 per product (SWD(2022) 282). Ask for a quote based on your written scope.
Tooling, such as SBOM and vulnerability tracking	Tool vendors or open-source project maintainers, plus internal operations	Recurring licences or hosting, plus setup. Driver: number of components and dependencies to track.
Recurring vulnerability handling and security updates	Your product security and support teams	Recurring for at least five years under Article 13(8), with updates available for at least 10 years under Article 13(9). Driver: incident volume and free update obligations.
Operating costs of conformity	Internal staff, tooling and audit support	Recurring. A targeted survey cited in the impact assessment put these at EUR 3,000 to EUR 5,000 per product (SWD(2022) 282).
Documentation retention	Your records and document management systems	Recurring for 10 years under Article 13(13). Driver: number of products and the storage and access controls you need.

How to read the Commission's cost estimates

The Commission's cost figures are a sense of scale, not a budget. The impact assessment SWD(2022) 282 estimated total costs for a complex product such as a router at EUR 126,000, but 90% of that was already expected to be incurred as business as usual, meaning spending the manufacturer would make regardless of the regulation. Self-assessment for software for telecom networks and complex IT systems was put at around EUR 30,000 to 50,000, also with 90% business as usual. The incremental cost attributable to the regulation is therefore a small fraction of the headline number, and it depends on how much security engineering, vulnerability handling and documentation your organization already runs. Before comparing any figure with your own spending, ask your team to separate existing costs from new ones line by line.

The aggregate figure needs the same care. The proposal COM(2022) 454 estimated compliance costs for software developers and hardware manufacturers of up to roughly EUR 29 billion, set against an estimated reduction in incident costs of roughly EUR 180 to 290 billion a year. Those numbers describe the market as a whole, across a very wide range of products, and they say little about what one product line will cost. They also rest on the 2022 proposal, whose product classification and conformity procedures differ from the adopted regulation. The impact assessment assumed that products needing third-party assessment would be no more than about 10% of the market. If your products fall into class I, class II or the critical category, that assumption may not describe your position, so the per-product averages understate your exposure.

Treat the per-product averages, EUR 18,400 for self-assessment and EUR 25,000 for third-party assessment, as inputs to a conversation with an assessor rather than as a quote. Both were built from secondary data in 2022, and the adopted route depends on your product's class and on whether you fully apply harmonized standards. Build your own estimate from the written scope of each product family, including the secure development work, the conformity route and the support period. Ask any consultant or notified body to show which assumptions drive its number, and confirm the current figures with the Commission's published materials and your national market surveillance authority before you set a budget.

What makes CRA compliance cost more or less

Most of the cost of Cyber Resilience Act compliance comes from a small number of decisions: which conformity route applies, what class the product falls into, how mature your development process already is, and how many product families you must document. Each card below names one driver and the control you can apply to it before you commit budget.

Conformity assessment route

Default products can follow self-assessment under module A without a notified body. Class II and critical products, and class I products where harmonized standards are not applied in full, need module B with module C, module H or a certification scheme under Article 32. A notified body charges for each assessment and audits your vulnerability handling or quality system on a periodic basis. Before budgeting, document which harmonized standards you will apply in full, because that choice can keep a class I product on the cheaper route.

Product class under Annex III or IV

Placing a product in the important class I or II categories of Annex III, or the critical categories of Annex IV, changes the assessment route and the depth of evidence an assessor expects. Classification follows the product's core functionality, and the Commission's technical descriptions in Implementing Regulation (EU) 2025/2392 are the reference for each category. Check classification early, because a product that moves from default to important or critical after design work starts can require redesign of documentation and testing.

Existing secure development maturity

The Commission's impact assessment, citing an academic calibration model, estimated that a secure product development lifecycle adds on average 30.5% to development costs where no comprehensive security measures exist. Organizations that already run threat modeling, secure code review, dependency scanning and a documented vulnerability process spend far less to meet Annex I. Ask your team which of these practices are already in place, and record the gaps in a readiness assessment before requesting quotes.

Number of product families and variants

Each product family needs its own risk assessment, technical documentation, support period record and declaration of conformity. Many variants that share code can be grouped into one family with shared evidence, while unrelated products multiply the work. Before you scope, map every SKU, firmware branch and deployment model to a product family, and ask any partner to price the work per family rather than per product page. Where your products share a codebase, confirm with the assessor how shared evidence will be accepted.

Support period length

Article 13(8) requires a support period of at least five years, and Article 13(9) requires each security update to remain available for at least 10 years. Longer support periods extend the cost of vulnerability monitoring, patch engineering, testing and documentation retention, which Article 13(13) sets at 10 years. Free security updates are required except for agreed tailor-made products under Annex I Part II point (8). Ask suppliers to quote recurring support as a separate line that runs for the full period, not a one-time figure.

Third-party components and open-source dependencies

Every third-party or open-source component you ship becomes part of your due diligence, SBOM and vulnerability management obligations. Components with active maintainers, clear security policies and frequent releases reduce monitoring effort, while abandoned or heavily forked libraries require replacement or internal maintenance. Inventory dependencies early, decide which ones you will support yourself, and confirm with your assessor how upstream vulnerability disclosures will be tracked and reported.

How SME fee reductions and support change the bill

The CRA gives microenterprises and small enterprises three forms of relief that apply when a notified body is involved. Article 32(6) requires notified body fees to be reduced in proportion to company size, Article 33(5) allows a simplified technical documentation form that notified bodies must accept, and Article 33(1) asks Member States to provide awareness, training, a dedicated communication channel and support for testing and conformity assessment. None of these removes the engineering work of meeting Annex I, the risk assessment or the vulnerability handling process.

Notified body fees: the reduction is proportionate, so the fee falls with company size, but the amount is set by each notified body and must be requested in writing.
Simplified documentation: the Article 33(5) form lowers the paperwork load, yet the content must still show how each essential requirement is met.
National support: Member State programs for training and testing vary by country, so confirm what your authority offers.
Microenterprise definition: confirm your headcount and turnover against the regulation before you rely on the lower fee or form.

Before you request a quote, confirm your enterprise category and ask the notified body to state the reduction in writing.

What CRA compliance costs after launch

The recurring cost of the Cyber Resilience Act starts when a product is placed on the market and runs for as long as the manufacturer supports it. The minimum support period is at least five years under Article 13(8), and security updates must remain available for at least 10 years under Article 13(9). Manufacturers pay for this out of their own budgets: engineers who triage and patch vulnerabilities, a vulnerability handling process that keeps running, and the infrastructure that delivers updates. Annex I Part II point (8) requires security updates to be free of charge, except for tailor-made products where the parties have agreed otherwise in writing. Before you sign a contract for a bespoke product, ask the vendor or partner to state in writing who pays for updates after handover, for how long, and at what rate, so that the support period does not become an open-ended liability.

Documentation is the other recurring obligation. Article 13(13) requires technical documentation and the EU declaration of conformity to be kept for 10 years after the product is placed on the market. Storage is cheap, but keeping the documents current, linked to the right product versions and retrievable by a market surveillance authority is ongoing work. Ask any implementation partner to specify in writing how documentation is versioned, where it is stored, who owns the retention schedule and what happens to it if the partner relationship ends. Under module B, a notified body carries out periodic audits of the manufacturer's vulnerability handling processes, and under module H it carries out periodic audits of the quality system (Annex VIII). These audit fees, the internal preparation time, and any remediation they trigger recur for as long as the route applies. Request the notified body's fee schedule and audit frequency before you commit to a route, and confirm them with the body directly, because the regulation does not set those figures.

How to scope and budget a CRA cost estimate

This sequence turns a vague worry about Cyber Resilience Act spending into a written estimate you can defend. Each step produces an artifact that narrows the cost, so the final budget reflects your actual product classes, conformity route and support commitments.

Confirm product classes and roles
Start by listing every product with digital elements you make, import or distribute, and note which role you hold for each. Check each product against the default, important (Annex III class I or II) and critical (Annex IV) categories, using the Commission's technical descriptions in the implementing regulation. Owned by legal or product compliance, with input from product management. Done when every product has a documented class and role, and any product you cannot classify is flagged for a written decision.
Establish the conformity route per product
Map each classified product to its conformity route. Default products can generally follow self-assessment under module A, while class II and critical products, and class I products that do not fully apply harmonized standards, need a notified body under module B with module C, module H or a certification scheme (Article 32). Confirm with your legal team which standards you will apply in full, because that choice can move a product between routes. Done when each product has a named route and a short written reason.
Run a gap assessment against Annex I
Assess each product family against the Annex I Part I essential requirements and the eight Annex I Part II vulnerability handling requirements. Record what already exists, what is partly met and what is missing, and note where the manufacturer's cybersecurity risk assessment leads to a requirement not applying, with the justification. Your engineers and security team do this work, and an implementation partner can help if you want an outside view. Done when each product family has a gap list that engineering can size.
Price internal and partner effort
Convert each gap into work items and estimate effort in person-days or equivalent units, separating internal engineering, security, legal and documentation effort from any external services. Note that the Commission's impact assessment found a secure development lifecycle can add a share of development cost where no comprehensive security measures exist, so ask whether your baseline already covers this. Where you use a partner, ask for a fixed-scope quote with deliverables and exclusions written down. Done when you have a costed work plan with each external line item tied to a written scope.
Price notified body or certification fees
For products on a notified body route, request written fee proposals from several notified bodies listed in the Commission's NANDO system, covering the initial assessment and the periodic audits that modules B and H involve. Ask how fees are set and whether any reduction applies, since Article 32(6) requires proportionate reductions for microenterprises and SMEs. Self-assessed products carry no notified body fee, but confirm that your own testing or documentation work still appears in the plan. Done when each notified body route has a quoted fee and a stated scope.
Set the recurring support budget
Build a multi-year budget for the support period, which must last at least five years under Article 13(8), and for keeping security updates available for at least 10 years under Article 13(9). Include vulnerability monitoring, patch engineering, the Article 14 reporting workflow, documentation retention for 10 years under Article 13(13), and periodic audits where they apply. Confirm with your counsel which updates are free under Annex I Part II point (8). Done when you have an annual recurring line for each product family with its assumptions written beside it.
Document assumptions and request quotes
Bring all cost lines into one estimate, and record the assumptions behind each: product count, classes, routes, reuse of existing security work and the support horizon. Note the Commission's impact assessment figures are estimates made for the 2022 proposal, which differs from the adopted regulation, so treat them as a reference point rather than a budget. Ask every vendor and notified body for a written quote that states scope, exclusions and what triggers a change order. Done when the estimate can be reviewed by finance and every assumption has an owner.

What usually inflates CRA budgets

Most CRA budget overruns come from a handful of planning errors, not from the engineering work itself. Each card below names one pitfall, why it moves the number, and the check to run before the budget is approved.

Budgeting from the 2022 estimates

The Commission's 2022 impact assessment estimated conformity costs per product, including EUR 18,400 for self-assessment and EUR 25,000 for third-party assessment. Those figures were calculated for the 2022 proposal, whose classification and procedures differ from the adopted regulation. Before using any figure, map each product to its class in Annex III or Annex IV and identify the conformity module that class requires. Ask your advisor to price that specific route, not the averages.

Assuming no notified body is needed

Most products can use module A, but class II products, critical products and class I products that do not fully apply harmonized standards, common specifications or certification schemes need a notified body under Article 32. Teams that plan only for self-assessment discover the third-party step late, when fees and audit scheduling are already set. For each product, confirm whether harmonized standards will be applied in full, because that answer decides whether the route is self-assessment or third-party assessment.

Treating open-source components as free

Using open-source components does not remove the manufacturer's obligations. The manufacturer remains responsible for the cybersecurity of the finished product, which includes component due diligence, tracking vulnerabilities in dependencies and maintaining the SBOM. Those activities consume engineering and monitoring time that a budget built on license costs alone will miss. Ask who in your organization owns component monitoring, how often it runs, and whether the tooling cost is in the plan.

Underestimating support period effort

Vulnerability handling applies for the whole support period, which must last at least five years under Article 13(8), and security updates must stay available for at least 10 years under Article 13(9). Recurring work includes monitoring, triage, patching, testing and documentation retention for 10 years under Article 13(13). Budget these as annual run costs, not as a one-off project. Ask for the expected release cadence and the staffing that will keep the product supported.

Leaving Article 14 reporting out

The Article 14 duty to notify actively exploited vulnerabilities and severe incidents has applied since 11 September 2026, and it covers in-scope products placed on the market before the full application date. Notifications go through ENISA's Single Reporting Platform to the designated CSIRT. Teams often budget only for the 2027 conformity work and leave out the on-call, triage, legal review and notification procedures needed now. Confirm the reporting roles, the escalation path and the tooling before the next budget cycle.

Skipping the quote scope check

Quotes that cover only the product or only the assessment leave gaps between them. A useful quote separates risk assessment, Annex I evidence, technical documentation, conformity assessment fees, notified body audits and recurring support. Ask each provider to state which items are included, which are excluded and which depend on your decisions. Fixed-scope agreements that list deliverables in writing make these gaps visible before work begins.

Who pays for what: your team, a partner and the independent body

The manufacturer owns the Cyber Resilience Act obligations, and that ownership does not transfer to a partner or an assessor. Your internal staff make the decisions that the regulation places on the manufacturer, and those decisions carry most of the accountable work.

Risk assessment: Your team decides the cybersecurity risk assessment that shapes which Annex I requirements apply to each product, and records the reasoning.
Technical documentation: Product owners and engineers maintain the technical file, which must be kept for the period the regulation sets, so this cost recurs with each release.
Declaration and CE marking: Only the manufacturer draws up the EU declaration of conformity and affixes the CE marking, after the conformity route is complete.
Vulnerability handling and reporting: Internal staff run the processes that must operate for the whole support period, including the Article 14 duty to notify through ENISA's platform.
Ongoing staffing: Internal time for security updates and support continues across the support period, which is a recurring cost to ask about in any quote.

Before you commit budget, confirm with your team which decisions you will keep in-house and which you will hand to a partner.

What to check before paying a consultant or notified body

Outside help on the Cyber Resilience Act can be a consultant preparing your evidence or a notified body issuing the conformity assessment, and the two are paid for different things. The cards below cover the checks that protect your budget: legal status, experience, independence, scope, deliverables and how the quote is split between one-time work and recurring fees.

Confirm notified body status in NANDO

Only a body notified by a Member State and listed in the Commission's NANDO system can carry out the third-party conformity assessment the regulation requires for class II and critical products, and for class I products that do not fully apply harmonized standards. Article 52 and the Commission's FAQ 6.9 explain the notification route. Check the listing yourself, confirm the listed scope covers your product category, and do not accept a certificate or logo as proof. A consultant without notified body status cannot substitute for that assessment, so a quote that implies otherwise should be questioned before any payment.

Verify product and technical experience

Ask for named people who have assessed or prepared evidence for products like yours, such as embedded firmware, SaaS backends or industrial controllers. Experience with Annex I essential requirements, vulnerability handling processes and technical documentation matters more than general security credentials. Ask for references you can verify with the organization, and ask which parts of the work the named staff will perform personally and which will be subcontracted.

Check independence from design work

A notified body cannot assess a system it helped design without creating a conflict, so the same firm should not both build your controls and certify them. A consultant can prepare your evidence, but the assessor must be independent of that preparation. Ask in writing who on the assessment team had any role in designing or documenting the product, and ask how the firm separates advisory and assessment work. A firm that offers to do both for one product should explain how the conflict is managed.

Require a written fixed scope

A scope statement should list the products, product versions, modules, conformity assessment route and the regulatory articles or annex points covered. It should also state what is excluded, such as legacy products, optional features or other product lines. Without a fixed scope, fees tend to grow as the assessment expands, and the timing of a notified body review depends on how much of the product is in play. Ask for the scope to be agreed and signed before any work starts.

Confirm the evidence you will own

Ask exactly what the partner hands over at the end: technical documentation, risk assessment records, vulnerability handling procedures, test reports, SBOM outputs and the EU declaration support files. You should own these files outright and be able to maintain them after the engagement ends. Note that an implementation partner prepares this evidence, while only the independent body issues an assessment outcome. If a deliverable is described as a certificate or attestation from the consultant, treat that as a warning sign.

Separate one-time work from retainers

Compliance cost has a one-time component, such as building the risk assessment, technical documentation and the conformity assessment itself, and a recurring component that runs across the support period. The Commission's impact assessment cited recurrent operating costs of EUR 3,000 to EUR 5,000 per product. Ask the provider to price each item separately, including ongoing vulnerability monitoring, security updates, reporting duties and periodic audits, so you can see which costs continue after the first assessment and which end.

Cyber Resilience Act compliance cost questions buyers ask

What is the cheapest compliant route under the Cyber Resilience Act?

For most products, the cheapest route is self-assessment under module A, which does not require a notified body. The regulation allows this for default products, and the cost then sits mainly in your own engineering, documentation and secure development work. The Commission's impact assessment SWD(2022) 282 estimated an average conformity assessment cost of EUR 18,400 per product for self-assessment, including one-off and recurrent costs, based on secondary data. That figure reflects the 2022 proposal, so treat it as a benchmark rather than a budget. Your actual cost depends on how many products you have, how mature your development lifecycle already is, and whether your product falls in an important or critical category that changes the route.

Is a notified body always needed for CRA conformity assessment?

No. A notified body is not needed for most products, which follow self-assessment under module A. Article 32 requires one for class II important products, for critical products, and for class I important products where harmonized standards, common specifications or certification schemes are not applied in full. Using the harmonized standards in full is therefore a cost lever: it can keep a class I product on the self-assessment route. Third-party assessment costs more, and the impact assessment estimated an average of EUR 25,000 per product for third-party assessment, based on secondary data. Confirm your product's class against the Annex III and Annex IV descriptions before you budget.

Does a small company pay less for CRA conformity assessment?

Yes, in part. Article 32(6) requires notified body fees to be reduced proportionately for microenterprises and SMEs, so the fee reduction applies only when a notified body is involved. Article 33(5) lets microenterprises and small enterprises use a simplified technical documentation form that notified bodies must accept, which reduces documentation effort. Article 33(1) asks Member States to provide awareness and training activities, a dedicated communication channel, and support for testing and conformity assessment. Ask which national programmes exist in your Member State, and ask any notified body to state its SME fee basis in writing before you sign.

How long does CRA compliance work take, and what does it need from staff?

No supplied figure gives a reliable duration, so plan from your own inventory. The work depends on how many products and product families you have, how many components each one contains, and whether your teams already run a secure development lifecycle. The impact assessment estimated that introducing a secure product development lifecycle adds on average 30.5% to development costs where no comprehensive security measures exist, based on an academic calibration model. Staff involvement usually spans product management, engineering, security, legal and support, because the risk assessment, technical documentation and vulnerability handling all need owners. Ask any adviser for a staffing plan by role with hours per milestone in the written scope.

Can we do CRA compliance in-house, or do we need outside help?

You can do it in-house if you have the skills, time and independence to run it, and many manufacturers with self-assessed products do. Outside help is most useful for gap assessment, documentation review, penetration testing, SBOM and vulnerability process design, and preparing evidence for a notified body. The organization always owns its products, controls and declarations. An implementation partner such as DeployOpen can prepare systems, controls and evidence, but only an independent notified body or auditor issues certificates or assessment reports. Ask for a written split of which tasks the partner performs and which remain with your team.

What recurring costs follow CRA compliance over the support period?

Recurring costs continue for as long as you support the product, which the regulation sets at a minimum of five years under Article 13(8). Each security update must remain available for at least 10 years under Article 13(9), and technical documentation must be kept for 10 years under Article 13(13). Security updates are free under Annex I Part II point (8), except for agreed tailor-made products. The impact assessment's targeted survey put recurrent operating costs of conformity at EUR 3,000 to EUR 5,000 per product. Budget for vulnerability monitoring, SBOM maintenance, reporting duties under Article 14, and periodic notified body audits under modules B and H where they apply.

Why do published CRA cost estimates differ from a real quote?

Published estimates differ because they were made for different assumptions. The impact assessment SWD(2022) 282 and the Commission's COM(2022) 454 proposal used the 2022 product classification and procedures, which differ from the adopted regulation. The estimates also used secondary data and assumed third-party assessment would cover no more than about 10% of the market. The impact assessment also reported that much of the cost for complex products was already incurred as business as usual, with 90% of total costs in the router example. A quote follows from your written scope: your product count, classes, existing controls and support commitments. Ask the provider to show which assumptions its quote uses.

Which official sources to check your figures against

Before any CRA budget is approved, check every cost figure against the adopted regulation and current Commission guidance, not only the numbers quoted in older material. The best-known estimates come from the Commission's impact assessment SWD(2022) 282 of 15 September 2022, which accompanied the 2022 proposal. That document estimated an average conformity assessment cost per product for self-assessment and for third-party assessment, along with recurrent costs. It was prepared for a proposal whose product classification and conformity procedures differ from the regulation that was finally adopted, so treat its per-product figures as context for the order of magnitude, not as a quote for your products. You can read the assessment on EUR-Lex.

The COM(2022) 454 proposal is the document to read next, because it explains the assumptions behind the aggregate cost estimates, including the share of products assumed to need third-party assessment. Then compare those assumptions with the adopted text. The conformity route is the single biggest driver of cost, so check the module requirements for your product class in Article 32, the reduced notified body fees and simplified technical documentation for microenterprises and SMEs in Articles 32(6) and 33(5), and the support period and update obligations in Article 13. Ask any notified body or consultant quoting you to state which article and which product class their price assumes.

Finally, confirm that the guidance and implementing acts in force at the time of your decision still match your assumptions. The Commission's guidance published on 27 July 2026 and the Commission FAQs are the most current interpretive sources, and harmonized standards under request M/606 may change which route applies to you. Record the source, article and version next to each figure in your budget so that finance and audit teams can see what each number rests on, and schedule a re-check before each major planning cycle.

How DeployOpen scopes CRA readiness work

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares the systems and evidence that support your cost estimate and conformity route. We do not issue conformity declarations or certifications, and independent bodies make those determinations.

How we scope

Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
The written scope lists which products, product versions and support periods are covered by the work.
We ask which conformity route each product falls under, so the scope reflects the assessment you expect to need.
Quotes follow from the written scope, and we do not publish a price list.

How we build

We inventory the open-source and third-party components your products depend on, and record how each is maintained.
We set up the engineering processes that generate evidence, such as build records, SBOM generation and vulnerability tracking.
We document the security testing performed on the product, including application and API testing where in scope.
We build the technical documentation pieces you own, mapped to the Annex I requirements in your written scope.

How we hand over

You receive the documentation, configuration records and evidence artifacts listed in the written scope.
We walk your engineering, product and compliance staff through what each artifact shows and how it is kept current.
Your organization keeps ownership of its declarations, risk assessment decisions and any notified body relationship.
We confirm with you, in writing, which items remain open and which owner is responsible for each.

How we support

Ongoing support, upgrades and continuous security testing are available as retainers after handover.
A retainer can keep SBOMs, vulnerability records and support-period documentation current across the product lifecycle.
Ask us to confirm in the quote which support activities are included and how changes to scope are priced.
Retainer terms, response expectations and service levels are set in writing and are not assumed from this page.