THINK SAFE. THINK ICS.

Cyber Resilience Act (CRA) Consulting & Imlementation

Implementing the Cyber Resilience Act: We help manufacturers analyze CRA risks, understand requirements, and prepare products with digital elements for the European market in a secure and compliant manner.

✔ Comprehensive Risk Analysis
✔ Comprehensive Threat Analysis
✔ Structured Technical Documentation
✔ Security by Design
✔ Vulnerability Assessment
✔ Support for CE Conformity Assessment

Cyber Resilience Act: New Requirements for Manufacturers

The Cyber Resilience Act (CRA) is an EU regulation that governs the cybersecurity of digital products with hardware and software functionality. The goal is to ensure that products are developed, documented, and operated “secure by design” in the future, with clear requirements for manufacturers, importers, and distributors.

The CRA is intended for companies that develop, provide, or distribute products, for example,

  • Manufacturers of digital devices or embedded systems
  • Software developers with marketable applications
  • Providers of configuration software or remote services
  • OEMs, suppliers, or distributors
  • Importers and integrators

THE CYBER RESILIENCE ACT EXPLAINED IN DETAIL

CRA Readiness Check—Get Clarity in 30 Minutes!

Book a free, no-obligation consultation with our CRA experts now.
In 30 minutes, we’ll clarify:

  • Which requirements apply to your products
  • How our gap analysis provides quick clarity
  • What your next steps will be

BOOK A CONSULTATION

Why Implementing the Cyber Resilience Act Is Complex

The Cyber Resilience Act requires manufacturers to account for cyber risks throughout the entire product lifecycle. In practice, this applies not only to product development but also to risk analysis, vulnerability management, and preparation for conformity assessment.

Many companies are faced with questions such as:

  • What are the system limitations of my product?
  • How is a CRA-compliant risk analysis conducted?
  • How should vulnerabilities be assessed and documented?
  • What requirements apply to technical documentation and CE conformity?

Without a structured approach, the implementation process can quickly become confusing.

Our Services for Implementing the Cyber Resilience Act

Our CRA support begins with a GAP analysis, includes implementation packages tailored to various budgets, and doesn’t end with just the CE stamp. With VISCURITY, you have a tool at your disposal that combines risk analysis, threat modeling, and technical documentation into a single platform.

01. CRA Impact Assessment

  • Analysis of whether and to what extent products are subject to the CRA.
  • Analysis of whether products fall into the category of “Important Products with Digital Elements” or “Critical Products with Digital Elements,” distinguishing them from IEC 62443 and other standards.
  • Determining which type of CE Declaration of Conformity is required: self-declaration or the route through a Notified Body

Result: Documented analysis including product type, category, and recommended course of action.

02. CRA Gap Analysis / Readiness Check

In the gap analysis, the current status is systematically compared with the target status and the CRA’s requirements. To do this, ICS uses a specially developed checklist with over 100 checkpoints that provides a practical assessment of key manufacturer obligations, including:

  • Risk analysis
  • Required processes (secure development, vulnerability management, etc.)
  • Supply chain security
  • Technical documentation
  • User documentation
  • Retention Periods
  • Technical requirements ...

ics_gmbh_gap_analyse

03. Comprehensive Risk Analysis with VISCURITY

VISCURITY checks whether a vulnerability is accessible and exploitable . This is exactly what the CRA requires before measures are defined based on risk prioritization. With VISCURITY , you can implement CRA requirements in a software-supported and traceable manner:

  • Map risk analysis and threat modeling in a structured manner
  • Create and version technical documentation
  • Assess vulnerabilities and plan countermeasures
  • Security by Design

Resilience Strategy / Action Plan

We work with you to develop a realistic CRA roadmap, jointly prioritize the relevant requirements, and define implementation goals that align with your product, team, and budget. We also create customized offers for startups and SMEs to make getting started easier.

Goal: To develop a structured roadmap for integrating CRA requirements into development and product cycles.

ics_gmbh_viscurity

04. CRA Implementation

Security by Default

Service: Assistance in translating CRA requirements into concrete measures.

  • Products must be shipped without known vulnerabilities
  • The integrity of the software must be protected
  • Protective measures must be active by default

Result: Hands-on support through the entire process until a compliant, ready-to-use solution is achieved.

SBOM & Update Management
  • Service: Creation and maintenance of a Software Bill of Materials (SBOM). Definition of support and update processes.
  • Result: Transparent SBOM, documented update strategy, and verifiable compliance for auditors.

Vulnerability Management

  • Service: Establishment of a vulnerability reporting process. Setup and training of a Product Security Incident Response Team (PSIRT).
  • Result: Vulnerability management process, defined workflow, templates for security advisories.
  • Goal: To implement key requirements in practice within product design and processes.

Training & SDLC Integration

  • Services: Conducting hands-on training for developers, project managers, and security roles. Integrating Security by Design into the software development lifecycle (SDLC).
  • Result: Trained team, documented process adjustments, and sustainable integration of security into the lifecycle.

  • Goal: Prepare teams, pass audits, and sustainably embed Security-by-Design within the organization.

05. CE Certification & Documentation

CE Conformity Assessment

  • Services: Support throughout the entire CE process in accordance with CRA. Preparation of technical documentation; liaison with notified bodies.
  • Result: Complete documentation for CE marking

Documentation

  • Service: Consulting and preparation of documentation required under the CRA, ranging from product descriptions and development processes to risk assessments, test reports, and the EU Declaration of Conformity.
  • Result: A structured, audit-ready dossier that covers all mandatory content in accordance with Article 31.

ics_gmbh_viscurity_report_white

06. Aftermarket & Operations

Continuous Monitoring

  • Service: Support for or management of the vulnerability management process and continuous risk analysis to identify and assess exploitable vulnerabilities.
  • Result: VISCURITY as a tool for continuous monitoring and vulnerability remediation, offered either as a managed service or on a self-service basis.

Product Registration & Regulatory Controls

  • Service: Consulting and implementation regarding reporting requirements. Establishment of internal compliance control mechanisms.
  • Result: Registered products; a centralized overview of regulatory obligations.

  • Goal: Remain compliant with the law even after market launch, report vulnerabilities, and document updates.

How VISCURITY Supports CRA Implementation

The Cyber Resilience Act requires not just security on paper, but traceable measures throughout the entire product lifecycle. This is exactly where our IT/OT risk management tool, VISCURITY, comes in: as a practical tool for manufacturers, system administrators, and developers of digital products.

Comprehensive Risk Analysis

With VISCURITY, you can systematically identify all security-related risks—from design through operation. The platform combines regulatory requirements with technical depth and offers clear methods for assessing threats and vulnerabilities.

Comprehensive Threat Analysis

VISCURITY uses structured attack tree methods to identify potential vulnerabilities, scenarios, and chains of impact—in line with the “security by design” principle. This lays the foundation for effective protective measures and transparent decision-making.

Structured Technical Documentation

All assessments, actions, and analyses are automatically documented in VISCURITY. This allows you to meet the CRA’s technical documentation requirements without any additional effort.

Security by Design

With VISCURITY, security isn't an afterthought—it's an integral part of your product development. The platform helps you identify security requirements early on and incorporate them directly into the design.

Vulnerability Assessment and Action Planning

The risk and threat analysis in VISCURITY automatically identifies areas requiring action—including an assessment of the impact and prioritization. This allows you to develop and document targeted measures.

Assists with CE conformity assessment

VISCURITY does not provide CE certification—but it does provide everything you need to obtain it: robust risk analyses, documented evidence, and a transparent safety rationale to serve as the basis for your CRA declaration of conformity.

VISCURITY - The Comprehensive Risk Management Tool

How VISCURITY, as a digital risk management tool, helps companies implement technical and regulatory requirements such as CRA, NIS2, and IEC 62443 efficiently, transparently, and automatically—including an invitation to a live demo.

LEARN MORE
ics_secira_modeling

The CRA project becomes a comprehensive, tailored solution

We put together modular services tailored to your requirements and budget: penetration testing, IEC 62443 certification, secure operations, and CISO as a Service. This turns the CRA foundation into a comprehensive roadmap, from risk analysis all the way through to operations.

Penetration Testing for Products & OT

Identify vulnerabilities in firmware, interfaces, and the cloud. The results support your CRA risk assessment, help prioritize actions, and can be documented in VISCURITY.

 

LEARN MORE

IEC 62443 Certification

Classify your product according to standards, close gaps, and prepare for audits. Ideal as a supplement to CRA implementation, including a mapping between CRA requirements and IEC 62443.

 

LEARN MORE

Secure Operations

Comply with post-market obligations: PSIRT, CVD, patch and update processes, SBOM/VEX, and reporting. Keep your documentation up to date and link it to VISCURITY.

 

LEARN MORE

CISO as a Service

Get temporary strategic security leadership: governance, roles, roadmap, and reporting. Manages your CRA program and coordinates interfaces with IEC 62443 and audit partners.

 

LEARN MORE

Secure Development (Security by Design)

Embed security into the development process: threat modeling, clear requirements, code reviews, and CI/CD checks (SAST, DAST, SCA, SBOM). Evidence is fed directly into VISCURITY.

 

LEARN MORE

Part: 01

Focus on CRA Responsibilities:

Risk analysis, vulnerability exploitation, and compliance over decades.

Part: 02

CRA Deep Dive:

Risk analysis, vulnerability exploitability, and compliance over decades.

Part: 03

CRA Risk Analysis in Practice:

CRA Risk Analysis: From System Model to Product Life Cycle.

Is my company affected by the CRA?

If you develop, distribute, or import products that include digital features, then it is highly likely that the CRA applies to you.

Typical examples:

  • Software tools for machines, vehicles, control units, and the IoT
  • Digitally connected products with embedded software
  • Remote service platforms for configuration, maintenance, or monitoring
  • Digital products designed for critical infrastructure (e.g., KRITIS, OT interfaces)

What exactly does the CRA require?

  • Conducting a risk and threat analysis prior to market launch
  • Implementation of technical and organizational security measures (“Security by Design”)
  • Traceable documentation of safety functions
  • Conformity assessment and CE marking in accordance with the CRA

When does the CRA take effect?

  • Adoption at the EU level: to take place in 2024
  • Transition period: 36 months (for new products)
  • Mandatory implementation: effective Dec. 11, 2027
  • Mandatory reporting of vulnerabilities begins as early as September 11, 2026
  • For existing products that continue to be marketed after the effective date, a transition period of 21 months applies

What happens in the event of violations?

Fines

up to €15 million or 2.5% of global annual revenue

Sales ban

of the affected product throughout the EU in cases of significant risks

Liability Risks

for management and those responsible for manufacturing

Seminar: The Cyber Resilience Act in Practice

Learn what the Cyber Resilience Act specifically means for your company and how to implement its requirements in practice. Register now for free and exchange ideas directly with experts from the field.

📅 October 15, , 2026
🕘 2:30 PM – 8:00 PM
📍 Stuttgart

LEARN MORE
ics_gmbh_cra_seminar_oct_15_stuttgart

FAQ

How can I have my company's compliance with the Cyber Resilience Act requirements assessed?

A structured CRA audit typically begins with a scoping assessment and a gap analysis. This involves analyzing which products fall under the Cyber Resilience Act, which manufacturer obligations are relevant, and which requirements are already being met. In addition, existing processes, risk analyses, vulnerability management, technical documentation, and security measures are evaluated.

ICS supports companies throughout the entire process, from the initial assessment to the concrete implementation of the CRA. This includes, among other things, scoping assessments, gap analyses, risk analyses using VISCURITY, support for Security-by-Design, vulnerability management, as well as the preparation of technical documentation and CE conformity assessment.

How do you begin implementing the Cyber Resilience Act?

The first step is usually to determine whether a product falls under the Cyber Resilience Act. Next, risks are analyzed, and the necessary measures for development, operation, and documentation are defined.

Do companies need a gap analysis for the Cyber Resilience Act?

A gap analysis helps companies understand which requirements of the Cyber Resilience Act are already being met and where adjustments will be necessary.

How long will it take to implement the Cyber Resilience Act?

The effort involved depends heavily on the product, its complexity, and existing security processes. In many cases, implementation begins with a structured analysis of existing systems and development processes.

Which companies should start addressing the CRA early on?

Companies that develop or distribute products with digital elements should determine early on which requirements apply to their products.

What role does a risk analysis play in the Cyber Resilience Act?

Risk analysis is a key component of CRA implementation. Manufacturers must identify and assess potential cyber risks and determine appropriate security measures.

What software can help with implementing the CRA's security requirements?

With VISCURITY, ICS supports companies in implementing the CRA through a holistic approach to risk management. This includes, among other things, modeling products and environments using a digital twin, assessing vulnerabilities in terms of accessibility and exploitability, analyzing attack paths, and conducting continuous risk analysis throughout the product lifecycle. This enables risks to be assessed in a structured manner and countermeasures to be derived in a transparent way.

CRA or IEC 62443—which standard applies to which product and when?

Does your product fall under CRA, IEC 62443, or both? Find out quickly and easily with our questionnaire and concrete examples.

READ THE ARTICLE

CRA Vulnerability Assessment & Exploitability Explained

When Is a Vulnerability in the CRA Exploitable? Why Product Context, Operating Environment, and Real-World Attack Vectors Are Critical for Risk Analysis.

READ THE ARTICLE

CRA Risk Analysis in Practice: How Products Are Assessed Throughout Their Lifecycle

How does a CRA risk analysis based on harmonized standards work? Product context, vulnerability assessment, risk matrix, and life cycle—all with a practical focus...

READ THE ARTICLE

Recent Posts

Book a consultation now!

During the initial consultation, we’ll determine whether CRA, IEC 62443, or both apply to you, and whether a GAP analysis or our Basic Implementation Package is the right place to start. We’ll show you live how VISCURITY accelerates your implementation.