EU Cyber Resilience Act Compliance

Катерина Дубас Legal IT Group
Kateryna Dubas
Head of Privacy and Cybersecurity Practices
Contact us
We support CRA compliance for businesses entering the EU market and product companies.
Катерина Дубас, голова практик приватності та кібербезпеки

Why us

Supporting cybersecurity since 2018

We take a systematic approach to cybersecurity policies and processes, from the GDPR to the CRA
  • CIPT certifications

    A cornerstone of our practice: technical measures for data protection compliance
    title_icon
  • 10+ years of experience in IT

    We have supported clients with breaches, documentation and audits
    icon
  • Working with German partners

    We implement leading European practices
    related_icon
Send a request

Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track – Cyber Resilience Act (CRA) Compliance Track –

  • 01

    CRA Applicability Assessment

    We assess whether your company falls within the scope of the regulation and which obligations it must fulfil
  • 02

    CRA Gap Assessment

    We review your current cybersecurity programme (processes and documentation) and prepare an action plan
  • 03

    CRA documentation

    We help develop the required vulnerability management policies, user manuals, declarations of conformity and other documentation
  • 04

    CRA processes

    We support the adaptation of product architecture and functionality, the development of new products and the discontinuation of support for older ones
  • 05

    CRA incidents

    We prepare you to notify supervisory authorities of breaches and respond to subsequent regulatory action, and support the mitigation process
  • 06

    CRA training

    We explain the CRA requirements in detail using your organisation as an example, covering the EU regulatory landscape and the consequences of non-compliance
  • 07

    CRA support

    We support applications for SME assistance with conformity assessments, responses to requests from regulators and users, vendor assessments and much more

what is included? – what is included? – what is included? – what is included? – what is included? – what is included? – what is included? – what is included? –

red-folder Processes
Documents
  • Vulnerability management

    We help establish processes for disclosing, receiving and handling vulnerability information
  • Vendor / supplier due diligence

    We assess suppliers of components, manufacturers, importers and distributors
  • Outsource compliance checks

    We review open-source stewards' documentation for compliance with the CRA requirements – and more
  • Incident and risk notification

    We support notifications to regulators, manufacturers and users about identified vulnerabilities and non-technical risks
  • Modification and sunsetting management

    We help you assume the role of product manufacturer following a product modification and discontinue support for previous product versions
  • Bugbounty programs

    We support the design and implementation of bug bounty programmes
  • Update management

    We help prepare update release documentation, product change notices and responses to users' queries about updates
  • Regulator relations

    We support your company in communications with CSIRTs, ENISA, data protection authorities, market surveillance authorities and notified bodies on risks, vulnerabilities, incidents and other matters
  • Cybersecurity risk assessment

    We help identify and assess risks and develop risk mitigation strategies for data, systems and their components
  • Vulnerability disclosure policy

    We draft internal and external vulnerability management policies and support their implementation
  • User instructions and manuals

    We help prepare clear, accessible information about security measures for instructions, manuals, notices and other user-facing materials
  • Technical documentation

    We support the preparation of the technical documentation package required to place products on the EU market
  • Declaration of conformity and CE marking

    We help prepare the declaration of conformity and its simplified form, and guide you through assessment by the responsible authority or certification body
  • Update and patch information

    We draft notices explaining the content of updates and patches, and assess whether an update should be deferred
  • Support period calculation

    We analyse local regulatory requirements, recommended support periods and competing products, and document our assessment
  • Notification to users and authorities

    We help draft and send notifications to authorities, manufacturers and users on various CRA compliance matters – and more
implementation_icon

How do we implement this?

  • Updated roles and responsibilities

    implementation_icon1
    We identify roles and responsibilities, support existing processes and establish compliance processes – both internal and those for dealing with regulators and users.
  • Documents, processes and evidence

    We organise risks, record the results of audits and assessments, prepare documents, track their update and review dates, support periods and other relevant information
  • Team training

    We deliver online training and prepare accompanying tests for your team, taking your industry, market, products and business context into account
  • CRA support on a case-by-case basis

    icon
    We can agree on further involvement for specific cases or projects as and when needed

How much does it cost?

€120/hour
Depending on the complexity and specific requirements of your request
Send a request
implementation_icon2

Team

Key data protection specialists

From discovery to a structured compliance dashboard. Who can help?

Certified experts

Certifications in the field of data protection

Internationally recognised expertise

Катерина Дубас. Кібербезпека
Катерина Дубас_кібербезпека
Катерина Дубас_кібербезпека
Антон Тарасюк. CIPP/E
CIPP/E Dubas
CIPPE_Kotkov
CIPT_Dubas
FIP_Dubas
FIP_Tarasiuk