Regulatory Standards · European Union
EU Cyber Resilience Act
Cyber Resilience Act readiness for products you ship.
The CRA sets cybersecurity requirements for hardware and software sold in the EU, including vulnerability handling and reporting. Astragar tracks product vulnerabilities and the evidence behind them.
Register interest in EU CRAComing to Astragar GRC
24h
Early warning to ENISA for actively exploited vulnerabilities
11 Sep 2026
Reporting obligations have applied since this date
11 Dec 2027
Full application of the regulation
What EU CRA requires
The obligations, in brief.
Secure by design
Essential cybersecurity requirements across the product lifecycle.
Vulnerability handling
Identify, document and remediate vulnerabilities, including via SBOMs.
Reporting
24-hour early warning, 72-hour notification and a final report via ENISA.
Conformity
Conformity assessment and technical documentation before market.
How Astragar helps
From checklist to measurable risk.
01
Requirement → control mapping
Map every EU CRA requirement to controls, systems, assets and owners.
02
Evidence, continuously
Collect and maintain evidence, with sign-off from contributor to IT auditor, CISO and executive office.
03
Exposure behind the gaps
See which vulnerabilities and sensitive data put EU CRA controls at risk.
04
Risk in financial terms
Prioritise remediation by business and financial impact, not checklist order.
Reporting already applies. Astragar prioritises exploited vulnerabilities so the 24-hour clock isn't a surprise.
Sign-off workflow
Evidence Contributor
→IT Auditor
→CISO
→Executive Office
Related · Government, Critical Infrastructure & AI
European Union
NIS2 →
Saudi Arabia
NCA ECC →
United States
FedRAMP →
United States
CMMC →
European Union
EU AI Act →
Global
ISO 42001 →
Global
NIST AI RMF →
Find the data. Test the controls. Reduce the risk.
EU CRA mapping is coming to Astragar GRC. Talk to us about early access and how your existing evidence already applies.
Talk to usAstragar supports compliance programmes with technical evidence and risk analysis. It does not provide legal advice or issue certifications.
See your cyber risk in $ terms, not CVSS scores.
