Guides
Cyber Resilience Act guides
Plain-language guides for engineering and quality leads at companies that make connected products sold in the EU.
CRA vulnerability reporting requirements
What to report, the 24h, 72h and 14-day deadlines, user notification and fines.
ENISA Single Reporting Platform: how to file
Access, assigned representatives, choosing a CSIRT, and what each form asks for.
PSIRT for small device makers
The minimum viable product security team: roles, intake, triage and service levels.
CRA SBOM requirements
What the text says, what's still open, and a practical setup for small teams.
Cyber Resilience Act timeline
Every date from entry into force to full application in December 2027.