TrustnGoCyber Resilience Act
The Cyber Resilience Act (CRA) is a new EU regulation ensuring that all products with digital elements (hardware or purely software) are secure by design and throughout their lifecycle.
Key requirements include risk management, timely security patches and incident reporting. From December 2027, products placed on the EU market must comply and display CE certification marks for cybersecurity conformity. Benefits include stronger consumer confidence and standardized European security practices.
TrustnGo provides consulting, assessment and testing to help your organization meet CRA requirements before the December 2027 deadline.
Our six-step approach
- 01
Mapping products and processes
Lists products and processes of the organization to obtain a clear view on how the organization operates and what kind of products or services it sells.
- 02
Gap analysis at organizational level
Use the previous mappings to perform a gap analysis versus the general essential requirements of the CRA at organization level (Secure Development Life Cycle, product life-cycle, vulnerability management, etc.).
- 03
Define a compliance roadmap
Define a compliance roadmap at the organization level including setting up a compliant SDLC and life-cycle management as well as establishing a training plan to help technical people to improve their skills.
- 04
Risk & gap analysis at product level
Now the implementation of the compliance roadmap is on the rail at organization level, tackle the problem at product level by identifying the technical gaps that really need to be filled to comply with CRA essential requirements.
- 05
Fix the gaps with our advice
Actually fix the gaps by effectively deploying new processes and methodologies. Also, prepare check-lists mapping general standard requirements to product specific requirements that can be efficiently and repeatedly implemented by dev teams across all the products.
- 06
Demonstrate compliance
Write supporting technical documentation and carry out penetration tests on products, web interfaces or backends, and mobile applications.
Discover Our Key Strengths
One-Stop Shop
From initial audit to full CRA compliance, TrustnGo handles the entire process including gap analysis, technical advice, documentation writing & pentests.
Integrated Technical & Regulatory Expertise
TrustnGo combines deep knowledge of EU cybersecurity regulations with hands-on experience in securing digital products.
Time Savings and Risk Reduction
By anticipating CRA obligations, you secure your products early, minimize compliance risks and costs, and strengthen customer and partner confidence in your brand.
Why choose TrustnGo
Securing an embedded device can be a challenge and demonstrating this security is another one.
During the past years, the EU has severely tightened cybersecurity requirements for IoT & embedded devices. NIS2, RED Directive, CRA, Regulation of machinery, … TrustnGo follows all these topics and has developed a comprehensive and cost-effective methodology based on our expertise in EN 303 645, EN 18031, IEC 62443, etc.
As a one-stop-shop, we also deliver technical advice on how to implement security functions, and we perform penetration testing to assess the robustness of your implementation.
We can act not only at the product level but also at the company level to achieve sustainable and reproducible compliance.
Example Case
A company selling solutions embedding a custom internet gateway, with wireless interfaces and already compliant to EN 18031-1/2, wants to comply with CRA requirements.
The solution is considered as a whole, including the web interfaces, the backend and the related mobile application. A risk & gap analysis is conducted and the EN 18031's evidence are completed to demonstrate the conformity of the solution.
In addition, a secure development life cycle is deployed at company level and vulnerability management is fully integrated to the company's processes.
