Your Hardware CRA-Compliant — From Schematic to a detailed Report in 48 Hrs.

EU Cyber Resilience Act · Fully effective as of December 11, 2027
We review your product’s schematic and bill of materials (BOM) against the hardware requirements of the EU Cyber Resilience Act, identify architectural gaps, missing security components, and unaddressed vulnerabilities—and deliver a written, clause-by-clause gap report with prioritized recommendations for fixes. Within 48 hours. Or you’ll receive a full refund.
Reserve an audit slot

 ✓ 48-hour guarantee or full refund ✓ Fixed price starting at €1,950 ✓ Evaluation without a prototype ✓ Only 5 audit slots per week 

The Problem

There is no standard that you can simply adopt.

The JRC/ENISA analysis of the CRA standards landscape notes that horizontal standards lack analog specifications for secure hardware design. Specific hardware requirements are found exclusively in the IACS-related IEC 62443-4-2—so you cannot simply certify to a standard and be considered compliant.

And based on the schematic and BOM alone, your team usually cannot determine whether the safety architecture meets the essential requirements—or what needs to be addressed first. The CRA requires compliance nonetheless, with full implementation effective December 11, 2027.

11.12.2027
Full implementation of the CRA—including the hardware requirements specified in Annex I.
up to 15 million euros
or 2.5% of global annual revenue — maximum fine for noncompliance.
Weakest point
Secure hardware design is the CRA area that is least well covered by standards.

The Solution — CRA Hardware Design Audit

Engineering expertise for secure hardware—exactly where the standard falls short.

Two levels of verification—schematic/circuit design and bill of materials (BOM)—are compared against the hardware requirements in Annex I of the CRA. Can be evaluated based solely on your design documentation, without a prototype. Fixed price, fixed deadline.

Hardware Root of Trust
Trust Anchors in Silicon: Is the Chain from the Device to the Application Cryptographically Anchored?
Secure & Measured Boot
Signed, verified boot path and verifiable integrity—no security vulnerabilities at boot time.
Secure Key Storage
Secure Element, TPM, or PUF: Where Are the Keys—and Are They Protected Against Being Read?
Tamper, Fault, and Side-Channel Resistance
Countermeasures against tampering, fault injection, and side-channel attacks were evaluated at the circuit level.
Vulnerability Mitigation
Are the debug interfaces (JTAG/UART/SWD) disabled or subject to access control? Are any unnecessary paths closed?
Secure Update Path
Signed updates and the corresponding hardware hooks for the patch path required by the CRA.
Power-Rail-Isolation & Secure Storage
Power supply, secure storage areas, and their isolation against physical attacks.
Security ICs in the BOM
Are the right security components (SE/TPM/PUF) installed—or are they completely missing from the design?
Reference Platforms
Microchip PolarFire & TrustMANAGER, Infineon OPTIGA, NXP EdgeLock, ST STM32Trust, Analog Devices — Assurance based on risk along the SESIP/PSA and EUCC/AVA_VAN frameworks.

The 48-Hour Schedule

From file to report—in two business days.

A senior engineer, a fixed schedule, and a dual-review process before delivery.

1
File Inbox
We will receive your schematic and BOM, and a senior engineer will be assigned to your audit.
2
Scope Confirmation
We confirm the scope of the audit and the product context—no scope expansion thereafter.
3
Draft of the Findings
The initial findings are in: the list of vulnerabilities, severity levels, and the most critical fixes are becoming clear.
4
Report + Debrief
Final report following a dual-review process, plus a 30-minute debrief with the reviewing engineer.

What You'll Get

An expert opinion ready for a decision—not just an opinion.

Everything in writing, with references to specific clauses and prioritized, so your team can take action the very next day.

  • Branded Audit Report (~8–15 pages) — a comprehensive assessment of your hardware security architecture.
  • Risk Matrix — Finding × Severity × Effort, so that prioritization is immediately apparent.

  • Compliance Readiness Score (0–100) — a reliable metric for management and the roadmap.

  • CRA Gap List with clause references — each gap mapped to the specific Annex I requirement.
  • Prioritized recommendations for schematic and BOM corrections — with implementation guidelines, including at least 3 specific actions.
  • 30-minute debrief — directly with the reviewing engineer, plus an optional indicative implementation proposal.

Packages & Prices

Fixed price. Fixed deadline. No prototype required.

Three Levels — From a Single Product to a Product Family, Including a Firmware Architecture Review.

 

 

 

 

 

 

Report within 48 business hours—or a full refund.

If your report is not available within 48 business hours of our receipt of the complete schematic and BOM, we will refund the full amount. Requirements: Files uploaded within 4 hours of booking, readable/unencrypted, a paragraph explaining the product context included, and debrief availability within 5 business days.

Free for up to 14 days

Fix-It-Roadmap

Implementation sequence for your fixes, valued at €490 — free if the booking is confirmed within 14 days.

Risk-Free

Second Opinion Guarantee

A free 60-minute review if you have technical objections to specific findings in the report.

Template

CRA-Compliance-Tracker

Template for tracking your CRA progress across requirements and actions.

A Deliberately Clean Scope

We provide the hardware engineering assessment that the standards lack.

Fast, at a fixed price, and costable based solely on the schematic and BOM.

Clear boundaries ensure the result is reliable.

Included in the scope

  • Schematic/Circuit Design Verification
  • BOM Verification for Security Components
  • Compliance with Annex I, Part I of the CRA
  • Root of Trust, Secure Boot, Key Storage
  • Attack Surfaces & Debug Interfaces
  • Secure Update Path (Hardware Hooks)

Not included

 

  • EMC testing (Directive 2014/30/EU)

     

  • Firmware code review

     

  • Penetration testing

     

  • Prototype/hardware lab testing

Firmware architecture at the block diagram level is included in the Max tier. Implementation of the fixes: separate engagement.

For Whom

For hardware manufacturers who want to make their product CRA-ready.

SMEs to mid-market companies (approx. 10–500 employees) whose internal teams lack the time or product security expertise related to hardware. Geography: DACH, Benelux, Nordics.

Audits by experts: Over 30 years of experience in telecommunications and industrial communication — hardware-savvy, not just a generic paper checklist.

Frequently Asked Questions

What You Need to Know Before Booking.

Do you need a prototype or physical hardware?

No. The audit is intentionally designed so that it can be evaluated based solely on the schematic and bill of materials (BOM)—no prototype or lab tests are required. This makes it possible to conduct the review early in the design process at a fixed price. 

What happens if the report isn't available within 48 hours?

In that case, we will refund the full amount. The guarantee takes effect upon full receipt of the schematic and BOM and is contingent on the files being uploaded within 4 hours of booking, being readable and unencrypted, including a paragraph explaining the product context, and you being available for the debrief within 5 business days. 

Does the audit cover firmware, penetration tests, or EMC?

No—the scope is intentionally kept narrow: EMC is covered by a separate directive (2014/30/EU), and firmware code reviews and penetration testing are separate services. The Max tier also includes a firmware security architecture review at the block diagram level.

Which CRA requirements are reviewed?

The product characteristic requirements from Annex I, Part I, from a hardware design perspective—in particular (1) adequate cybersecurity, (2)(a) no known exploitable vulnerabilities, (2)(b) secure by default, (2)(c) security updates (hardware-supported update path), (2)(e) confidentiality/encryption, (2)(f) data integrity, and (2)(j) minimization of the attack surface. This corresponds to the manufacturer’s obligation under Article 13.
*** Translated with www.DeepL.com/Translator (free version) ***


How soon can we get started?

There is a maximum of 5 audit slots per week. After booking, please upload your schematic and BOM within 4 hours; the 48-hour countdown begins once we have received all documents. Be sure to reserve a slot early.

How much will it cost to implement the fixes afterward?

The design and remediation implementation (architecture of the fixes, adaptation of IEC 62443-4-2 from its IACS context) is a separate, more in-depth engagement—costing approximately €3,000–8,000, depending on the scope. Upon request, an indicative implementation quote will be included with the report.

Secure one of this week's five audit slots.

Get clarity on your CRA hardware compliance in 48 hours—or get a full refund. Schedule a free initial consultation where we'll define the scope and tier.