You've walked the full 6-phase CRA journey How mature am I compared to peers?
194 SMEs from 31 countries answered ENISA's survey on their readiness for the EU Cyber Resilience Act. The data reveals a clear gap between awareness and practice — and points at exactly where free, well-designed tooling helps. This page turns the report into an action list you can use today.
But awareness of the regulation does not translate into understanding what it requires in practice.
Only 13% rate their grasp of Annex VII documentation as good or very good — and only 14% for conformity assessment.
Threat modelling is an explicit CRA requirement, but the largest practice gap in the survey.
Two-thirds of SMEs still have no SBOM — a foundational CRA obligation for vulnerability handling.
Each of the four biggest gaps identified by the survey maps to a free tool on CRA Studio you can use right now. Deep dives below.
STRIDE-light in the browser — no login. Persist per dossier once you sign up.
Upload a CycloneDX or SPDX file and scan against OSV.dev — free.
The weakest ENISA domain overall. Generate CVD policy and security.txt in one sitting.
Answer 12 questions to see whether your product is Default, Class I or Class II under Annex III.
Half the SME landscape is micro. The survey shows they are also the least prepared — which is exactly the group free, no-login tooling can help most.
| Domain | At risk (L1 + L2) | Average score | On track (L4 + L5) | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Micro | Small | Medium | Micro | Small | Medium | Micro | Small | Medium | |
| Governance & Documentation | 49% | 19% | 36% | 2.5 | 3.0 | 3.5 | 9% | 41% | 53% |
| Risk Management & Secure-by-Design | 49% | 36% | 26% | 2.4 | 2.8 | 3.2 | 9% | 23% | 40% |
| Vulnerability & Patch Management | 40% | 30% | 19% | 2.6 | 3.0 | 3.3 | 8% | 25% | 44% |
| Incident Response & Lifecycle | 49% | 38% | 36% | 2.2 | 2.6 | 2.9 | 4% | 19% | 25% |
| Awareness, Competence & Skills | 49% | 35% | 26% | 2.5 | 2.9 | 3.3 | 6% | 22% | 43% |
The report ranks templates and technical tooling above every other form of support. CRA Studio's free tools directly address that demand.
| Templates for technical documentation | 73% asked for it | Build the Annex VII technical file |
| Secure-development templates | 71% asked for it | Free Threat Modelling wizard |
| Technical tools that help assess compliance | 68% asked for it | SBOM Scanner |
| Step-by-step CRA documentation guide | 66% asked for it | CRA Overview |
| Conformity assessment & CE marking guidance | 59% asked for it | Declaration of Conformity Generator |
| Product lifecycle & support-period policy | 58% asked for it | Lifecycle Policy Generator |
| Operator role clarity (manufacturer, importer, distributor) | 55% asked for it | CRA Role Check |
| ISO 27001 → CRA coverage mapping | 52% already hold ISO 27001 | ISO 27001 → CRA Mapper |
| Product classification guidance | 51% asked for it | Read the classification guide |
Every gap in the ENISA report maps to a tool you can use today without an account.
Regulation (EU) 2024/2847 enters into force. The phased application clock starts.
The rules on notifying authorities and notified bodies start to apply. This sets up who may certify products — it places no new obligation on manufacturers themselves.
Manufacturers must report actively exploited vulnerabilities and severe incidents : early warning within 24h, notification within 72h, final report 14 days after a fix (vulnerabilities) or one month after the notification (incidents). This is the only manufacturer obligation that lands on this date — and it applies to all products already on the market, including legacy products.
Everything else applies: Annex I essential requirements, conformity assessment, technical documentation, CE marking and the Declaration of Conformity. Non-compliant products may no longer be placed on the EU market.
Every free tool works without a login. Registration keeps the results and turns them into a shared, auditable compliance workspace.
One dossier per product with the CRA Annex I checklist, SBOMs, threat models and policies attached — no more scattered spreadsheets.
Invite colleagues with role-based access. Contributors edit, viewers audit — the audit trail records every change.
A PostgreSQL trigger writes every insert, update and soft-delete to the audit log. Ready for notified-body inspection.
The 0–100 score is recalculated automatically on every checklist change so you always know where you stand.