Services · done for you

Get ready for your first CRA report. Then let us file it.

For makers of connected products without an in-house product security team. Reporting tools still leave the filing to you. We do the work.

Week 1: we set you up

  • security.txt and disclosure policy, written for your products and published
  • Intake inbox and triage checklist, so reports reach someone who knows what to do
  • 24h / 72h / 14-day runbook for your products and team
  • Product and version register, so the 24-hour form takes minutes
  • ENISA platform access: EU Login with MFA, your coordinating CSIRT chosen, and a signed mandate naming us as a filer
  • 60-minute drill on a mock exploited vulnerability

After that: we're on call

  • We watch your security inbox and acknowledge every report within 4 hours, 7 days a week
  • We triage: is it real, is it exploited, which products, versions and countries
  • We draft and file your 24-hour early warning, 72-hour notification and final report as your assigned representative on ENISA's platform
  • We draft your user notice and advisory
  • Quarterly check of the components you ship against new vulnerabilities
  • Up to 3 product families per company
Get started

Starts after a short call and a signed agreement. Monthly after setup; cancel with 30 days' notice.

On call, step by step

How filing for you works

  1. You stay the manufacturer.

    ENISA's platform lets each manufacturer name up to 20 secondary representatives who submit for it. You add us as one and sign a short mandate letter.

  2. A report arrives.

    We acknowledge it within 4 hours, assess it with your engineers, and look for evidence of active exploitation.

  3. You get a clear call.

    We tell you "this appears reportable to us, because…" with the facts behind it. You confirm with your counsel.

  4. We file.

    The early warning goes in within 24 hours of you becoming aware, then the 72-hour notification and the final report. We draft the notice to your users.

If your coordinating CSIRT won't accept an outside representative, we fill in every field and you click submit while we're on a call with you. It takes about 10 minutes.

FAQ

Questions

Is this legal advice?
No. We do the technical and process work: triage, evidence, forms and timelines. When a case needs a judgement on whether it must be reported, we tell you what appears reportable to us and why, and you confirm with your counsel.
We're outside the EU. Does this apply to us?
Yes, if you sell connected products in the EU. The reporting duty covers manufacturers wherever they are based, and products already on the market.
What isn't covered?
Medical devices, motor vehicles, aviation and marine equipment have their own rules and sit outside the CRA. We don't do penetration testing or certification. For SBOMs and technical documentation ahead of December 2027, ask us about a documentation pack.
Can we talk first?
Yes. Send us a note with your products and timeline. We reply within one business day.