Your products need CRA compliance. You need to know what that actually means.

Our gap analysis typically takes 2-3 weeks: Week 1 for scope definition and product inventory, Week 2 for documentation review of your product security practices (SBOM generation, vulnerability disclosure processes, secure development lifecycle), and Week 3 for situation appraisal and reporting. The timeline can vary based on the number of products and complexity, but we'll give you clear deadlines upfront.

CRA applies to products with digital elements sold in Europe—hardware, software, and IoT devices. This includes everything from smart home devices to enterprise software applications. If your product connects to the internet, processes data, or has software components, it likely falls under CRA. Our gap analysis helps you identify which of your products are in scope and what requirements apply to each product category.

That's exactly why you do a gap analysis—to get objective answers about resource allocation. If you're spending remediation resources on low-impact gaps, you'll get a prioritized roadmap showing what to fix first based on CRA compliance impact. Some gaps are quick wins (documentation, SBOM generation tools), others take longer (secure development lifecycle implementation). The gap analysis helps you allocate resources efficiently and focus on gaps with highest regulatory compliance impact.

Not always, but it's highly recommended. If you already know your gaps (maybe from an internal assessment), you can jump straight to implementation. But if you're unsure where you stand compared to CRA requirements and best practices, the gap analysis gives you objective answers before investing time and budget. It's a separate 2-3 week engagement that pays for itself by preventing wasted resources on the wrong gaps.

You'll receive: (1) Compliance scorecard with product security maturity assessment across SBOM generation, vulnerability disclosure, secure development lifecycle, and CE marking readiness, (2) Prioritized gap list with risk-based ranking and resource impact assessment, (3) Remediation roadmap with cost/effort estimates for each gap, (4) Strategic recommendations on resource allocation for maximum CRA compliance impact, and (5) Clear next steps with timeline options to achieve CE marking compliance by December 2027.

Maybe, but CRA requires specific, documented evidence—not just good practices. While you may have secure development processes, CRA mandates formal SBOM generation, documented vulnerability disclosure procedures, and evidence of security-by-design principles. Most product teams have good security practices but lack the structured, documented approach CRA requires. The gap analysis shows you exactly what's documented, what's informal, and what needs attention for CE marking.

Yes, absolutely. We offer CRA implementation services as a separate engagement. After the gap analysis, you'll have a clear compliance scorecard and prioritized remediation plan. If you want us to handle the implementation—setting up SBOM generation, formalizing vulnerability disclosure processes, implementing secure development lifecycle—we can start immediately. Many clients do the gap analysis first to understand where they stand and allocate resources efficiently, then engage us for implementation.