Know whether the CRA applies. Close the gaps. Prove every release.
For manufacturers whose products contain software or connect to a network. We deliver the answer, the plan and the evidence as finished results, not as hours.
Does one of these sound like you?
Our product contains firmware or connects to a network. Does the CRA apply, and in which class?
ApplicabilityA customer or OEM is asking for an SBOM and a vulnerability-handling process.
Supply chainWe ship releases, but we could not show an authority how they were built and checked.
EvidenceOur open-source components are unmanaged and nobody knows the licences.
OSS governanceWe need a security review of an architecture or a codebase before the next release.
Review11 December 2027 is closer than our next product generation.
Deadline
Five results, each with a fixed price.
Every result comes with an evidence package that shows how it was produced and who signed it off. Your notified body or market-surveillance authority can check it without having to trust us.
- CRA applicability checkWhich of your products fall under the Cyber Resilience Act, in which class, and why. A classification you can hand to your notified body.Per product family
- CRA gap analysisGaps in processes, documentation and product against the essential requirements, prioritised by risk and effort.Per product family
- ImplementationSBOM and open-source governance, vulnerability-handling and reporting process, supplier security, signed releases and release gates in your pipeline.Per package
- Security architecture and code reviewRated findings with clear priorities, from the threat model to the fix.Per review
- Release evidenceongoingEvidence for every release, generated from your build pipeline and approved through ef.next Sign. The ongoing service behind the one-off results.Per product per month
The Cyber Resilience Act in two dates.
Reporting obligations
Actively exploited vulnerabilities and severe incidents must be reported, also for products already on the market.
All requirements apply
Essential requirements, technical documentation, conformity assessment and CE marking.
Regulation (EU) 2024/2847. Our five-question check helps you decide whether it applies to you.
Start with the applicability check. Continue only if it makes sense.
Workshop
Half a day with product management and engineering: product inventory, data connections, markets.
Applicability check
Classification per product family with reasoning. Result in two weeks.
Gap analysis
Our software reads repositories and pipelines first; Enrico reviews and rates the gaps.
Implementation
Templates and pipeline building blocks from our own repositories, adapted to yours.
Release evidence
Every release produces its own evidence package. Approved in Sign, checkable offline.
We apply to our own software what we recommend for yours.
Every ef.next result is produced on our own platform. Two parts of it matter for product security, and both are built the way the CRA expects a manufacturer to build.
- Security FrameworkOpen source for Laravel: fail-closed tenant isolation and a tamper-evident audit log with signed hash chains. MIT licence, source on GitHub. security-framework.ef-next.com · reports to [email protected]
- Release evidenceOur own releases are signed, ship with an SBOM and pass automated checks. The same pipeline building blocks go into your implementation.
- ef.next SignVerifiable approvals with an evidence package that can be checked offline. The document never leaves your device. A simple electronic signature with a strong audit trail, cryptographically verifiable.
Not sure whether the CRA applies to you? That is the first result we deliver.
Write to Enrico directly or use the contact form. The first conversation is free.