SECURITY · EU

EU Cyber Resilience Act (CRA)
Assessment & Implementation

The Cyber Resilience Act, Regulation (EU) 2024/2847, sets mandatory cybersecurity requirements for products with digital elements (hardware and software) sold in the EU. It entered into force 10 December 2024.

Who This Applies To

EU organizationsMakers and sellers of digital productsMSPs and their clientsLean IT teams carrying an audit

What EU Cyber Resilience Act (CRA) Covers

The CRA covers any product with digital elements, hardware or software, that is sold in the EU. It applies to manufacturers, importers, and distributors.

Manufacturers must build in security by design, provide security updates for the product lifetime (minimum 5 years), report actively exploited vulnerabilities to ENISA within 24 hours, and maintain technical documentation.

Fines reach up to 15M EUR or 2.5% of global turnover.

Official source: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act

ThreeShield's CISSP- and CISA-certified assessors run the EU Cyber Resilience Act (CRA) engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.

What is at stake

Fines up to 15M EUR or 2.5% of global turnover.

Where the Work Splits

EU Cyber Resilience Act (CRA) requirementLavawall® collectsThreeShield delivers
Multi-factor authentication status✓ Continuously—
Patch and vulnerability posture✓ Continuously—
Encryption at rest and in transit✓ Continuously—
Access and audit-log review✓ Continuously—
Risk assessment and scoping⚑ Platform dataCISSP/CISA-led
Policies, procedures, and evidence package—Written by ThreeShield

Frequently Asked Questions

It does if you manufacture, import, or distribute products with digital elements (hardware or software) sold in the EU. We confirm scope in the first call, at no charge.

A gap assessment against the CRA usually takes a few weeks. Closing the gaps and standing up the evidence takes longer, and that is where most of the work sits, so the total depends on your starting point. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.

Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.

Three Ways to Engage, from DIY to Done-for-You

ThreeShield meets you at your current security maturity. Every level includes Lavawall®.

Self-Serve

DIY via Lavawall®

For lean IT teams and cost-conscious organizations with internal security capacity

  • Lavawall® GRC with EU Cyber Resilience Act (CRA) control mapping
  • Continuous automated evidence collection
  • Live compliance dashboard and score
  • Policy template library
  • AI-generated status reports
Start with Lavawall®
Recommended for MSPs & Lean IT

Supported

Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity

  • Everything in the DIY tier
  • CISSP/CISA gap assessment
  • Prioritized remediation roadmap
  • Policy and procedure development
  • Quarterly compliance review calls
  • MSP white-label available
Get Supported Engagement
Fully Managed

Done-for-You

Full compliance delivery, managed end to end by ThreeShield

  • Everything in the Supported tier
  • Full compliance program management
  • CISSP/CISA-executed formal assessment
  • Detailed findings methodology
  • Complete documentation package
  • Annual reassessment included
Book Done-for-You

Ready to Get Compliant with the EU Cyber Resilience Act (CRA)?

Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.

Book a Scoping Call

DIY · Supported · Done-for-You