Cyber Resilience Act

What the Cyber Resilience Act module is and what it does in your company

The Cyber Resilience Act module in eIntranet is built for hardware and software makers who must comply with Regulation (EU) 2024/2847. You keep a register of products with digital elements, their versions and component lists (SBOM), watch for vulnerabilities and prepare reports for the ENISA platform. It also tracks the 24-hour, 72-hour and final report deadlines.

The module exists for a situation a manufacturer meets once every few years but must handle within a single day: a customer or a security researcher says a vulnerability in your product is being exploited. Since September 11, 2026, Article 14 requires you to report such cases, even for products placed on the market long before that date. A company without named people, a rehearsed procedure and an overview of its components starts sorting out its organization while the clock is already running.

The module does not replace a lawyer or a notified body, and it sends nothing to any authority. You submit the report to the ENISA SRP platform by hand in its portal. The module prepares the values in the right fields, watches the deadlines and keeps a record of what you submitted and when.

Three roles typically use it: the person responsible for the product, who keeps the register and SBOMs; the decision maker for exploit awareness with a deputy; and the SRP representatives, who actually file the reports. Management and consultants come for the gap analysis and technical documentation.

How the Cyber Resilience Act module works in eIntranet, step by step

Work in the module follows two tracks that meet in an Article 14 case. The first is everyday record keeping, the second is the crisis procedure.

Product and component register

On the Products with digital elements tab you create a product under the official name that will appear in reports and in the EU declaration of conformity. You answer whether it has a data connection, whether it falls under the CRA and which category it belongs to (default, important class I or II, critical). The module works out the CRA regime from your answers and it cannot be set by hand: the product is either out of scope, subject only to Article 14 reporting, or subject to the full CRA from December 11, 2027. Answering "Don't know" marks the product with a yellow question mark as uncertain.

You add a version to the product and upload its SBOM in CycloneDX 1.4 to 1.6 or SPDX 2.2, 2.3 and 3.0.1. Import has two steps: first a preview with a summary, a quality check and the difference from the previous version, and only then the Confirm import button. Components your tool cannot see (an RTOS, a bootloader, statically linked libraries) you add by hand, and later imports leave them alone.

From a vulnerability to a case

Once a day the module compares components with the public OSV source and with the catalog of actively exploited vulnerabilities. Each match becomes a finding in the Under assessment state. Depending on severity, the assessment deadline runs from 60 days for low to 7 days for critical; a vulnerability flagged as actively exploited (KEV) is assessed within one day. You assess a finding as Affected, Not affected (with a justification and evidence) or Fixed.

A match in an SBOM is not yet awareness under Article 14. You open the case yourself, with the red Open Article 14 case button, once you have reasonable certainty that the vulnerability is being exploited in your product. Anyone with read rights to the module can also raise a suspicion with the Report a suspicion button in the header.

Deadlines and submission

In the case detail the decision maker chooses Aware, Monitoring or Not reporting. Choosing Aware starts the countdown: early warning within 24 hours, notification within 72 hours. For a vulnerability the final report is due 14 days after the first available measure, for a severe incident one month after the notification. For each phase you click Prepare report, the form is prefilled from the case and the products, you copy the fields into SRP and record the submission with its report number in the module.

Everything the CRA module can do

• Product register with a category under Annexes III and IV, the conformity assessment procedure, the support period and the countries where the product is sold. The module warns you when the support period is shorter than the expected use time or under five years.
• Installed base: you assign customers from the CRM module to a product, and their country is used when proposing member states.
• Vulnerability findings with an Actively exploited (KEV) filter, bulk assessment of selected rows, and reuse of an earlier assessment when the same component in the same version is already resolved under another product version.
• Article 14 cases with states from Signal under assessment to Closed as reported, a timeline and a PDF case file for a supervisory authority or the archive.
• SRP report form following the SRP 1.3 glossary of September 25, 2026: field numbers, character counters, a check of required fields before submission and a Copy all button.
• Received vulnerability reports (numbers VR-…), a public form at /Security and a coordinated disclosure policy template in Czech, English and German.
• Gap analysis: 50 questions in seven areas A to G, a score at three levels, an action plan with a Create task button, a quarterly roadmap through December 11, 2027 and a PDF report.
• Conformity and technical documentation: Annex I requirements (I-1, I-2a to I-2m, II-1 to II-8), a 5×5 risk matrix, Annex VII, the EU declaration of conformity and user information under Annex II.
• Frozen outputs: the final gap analysis report, attachments of SRP submissions and approved document versions are stored with a SHA-256 fingerprint and can be neither overwritten nor deleted.
• History and trash: every change is logged with the user, time and the old and new value, including rejected attempts made without the right.

Reporting readiness: SRP representatives, leave and the 24-hour playbook

The most common reporting failure is not technical. Only a person who registered on the portal through EU Login with multi-factor authentication, and whose link to your company was verified by the coordinating CSIRT, can log in to SRP. A draft report is also visible in SRP only to its author. If your single representative is on holiday, nobody else has anything to log in with.

The module watches for this with the Reporting readiness (Art. 14) checklist on the CRA Overview tab. It has nine points: a verified primary and secondary representative, an SRP login tested in the last 90 days, a decision maker and a deputy (two different people), notification recipients, clear product classification, a contact point with a CVD policy, an exercise in the last 12 months, and staff availability over the next 60 days. SRP allows one primary and at most 20 secondary representatives.

With the Vacation module switched on, the Overview shows yellow bars for periods when none of the representatives, or neither the decision maker nor the deputy, can be reached. Only approved leave counts; pending and rejected requests do not. Once a day in the morning an e-mail lists gaps that start within 14 days.

For nights and weekends there is the one-page Playbook for 24 hours PDF: contacts for the decision maker and representatives with phone numbers from the user cards, the coordinating CSIRT, eight numbered steps from the first signal to parallel reports, and a table of the fields SRP wants in the early warning. Print it. And once a year, rehearse the whole procedure as a practice case labelled EXERCISE; an exercise starts no real deadlines, and the checklist asks for one.

How to choose a CRA tool: what to ask before buying

Does the tool separate record keeping from reporting?

Many tools offer only a component list. Ask whether the tool supports an Article 14 case with three separately running deadlines, and whether it calculates when a deadline starts. In the CRA module nothing runs until the decision maker records awareness with a date and a justification. A CVE match or a KEV catalog entry does not start the clock by itself.

Does the form match the real platform?

Reports are filed in English in the SRP fields. Check that the tool uses the same field names and numbers as the platform glossary and flags a missing required field before you fill it in a second time in the portal. The form in the module tells an actively exploited vulnerability from a severe incident, and it knows the reporting phase.

Will a trail remain after submission that you can defend?

A submitted report is locked, attachments are locked when the case is closed, and only an administrator can correct the awareness time, with a mandatory reason; the original value stays in the file. An update requested by the CSIRT under Article 14(6) is recorded as a separate entry.

What about products that are already on the market?

Reporting also covers the installed base placed on the market before December 11, 2027 and continues after sales end, after support ends and after decommissioning. Ask whether the tool determines the regime for you and whether it can separate hardware with new orders after December 10, 2027 from older units.

How much control does someone who never configured anything get?

Everyone with read rights can open the module and report a suspicion. Editing, finalizing and deleting are split into four rights levels. Who may change the SRP representatives is set by a separate level, CRA module settings.

The Cyber Resilience Act module for small manufacturers and companies with many products

A small maker of embedded devices with three people in development does not need a certified security team. It needs a product list, SBOMs and clarity on who reports. The module gives it a fixed sequence of steps and spares it from writing an internal policy from scratch. Company size is set in the module as micro (up to 10 employees), small (up to 50), medium (up to 250) or large. Everyone must report regardless of size; the module only records the size and prefills it in reports.

A software company with ten products and several dozen versions has the opposite problem: volume. Bulk assessment of findings, a filter by product, a reused assessment of the same component and a number on the menu item help here. The number counts suspicions waiting for assessment, cases in the Aware state and findings past their deadline. The CRA card on the dashboard summarizes open cases, the nearest deadline and the score of the latest gap analysis.

A consultant running a gap analysis for a client gets the CRA Administration level. Interviews are recorded on the Interviews tab, the client receives a report with a DRAFT watermark, and the consultant finalizes it. The next round is created as a copy with the answers carried over.

Where the CRA module gets its data: SBOM, OSV, the KEV catalog and received reports

Input

You upload the component list as an SBOM file. Quality is graded on three levels: the CRA minimum (a machine-readable format, the main component and top-level dependencies), the BSI TR-03183-2 level (CycloneDX 1.6 or later, or SPDX 3.0.1, purl or CPE identifiers, SHA-512 hashes, licenses) and a supplementary level. Findings arise only for components with a purl that includes a version or a valid CPE, so the version detail lists how many components monitoring cannot evaluate.

Daily monitoring reads the public OSV source and the EUVD catalog of actively exploited vulnerabilities, with the US CISA catalog as a fallback. Components with a CPE are also worked through in NVD, each roughly once a week. Reports from the outside world also arrive through the contact point: by e-mail, from a customer, from a CSIRT, or from the public /Security form, which is protected by a captcha and a limit of 5 reports per hour and 20 per day from one IP address.

Hardware

You need no hardware. The module runs in a browser, and for generating SBOMs you use the tools your development already has.

Output

You export the SBOM of a chosen version in CycloneDX 1.6 (a .cdx.json file). The gap analysis yields a PDF report, an action plan and roadmap (XLSX), and a list of supporting documents in both XLSX and PDF. A case produces a PDF case file, and from the Tasks module you can assign measures from the action plan to responsible people. The module builds the security.txt file under RFC 9116 itself from the contact e-mail; you publish it on your website as /.well-known/security.txt and renew it yearly, since it is valid one year ahead. The module sends nothing to SRP, to authorities or to customers.

How much the Cyber Resilience Act module costs

The module is included in every eIntranet plan, and there is no separate CRA license. You pay for users with access to the system, not for products, versions, components or the number of cases. So you never have to count how many products you can afford to register.

A worked example: a development team and two support people, 8 users on the Basic plan, pay 8 × €2.4 = €19.2 per month excluding VAT. If you grow by a consultant and management to 15 users, the rate for the band from 11 users applies: 15 × €2.1 = €31.5 per month. The Normal and Extra plans differ in storage per user (0.5, 2 and 4 GB) and in rate; all modules are included in each of them. The full price list is at /en/pricelist.

You need no hardware. If you want help setting up representatives and the procedure, we offer consulting and training at €40 per hour. Custom changes, such as a link to your development system, are bespoke programming, billed by the hour at the rate on the price list. Vulnerability monitoring and the AI helpers carry no surcharge; AI draws on the company's credits and is switched off by default.

Free CRA options: what works without paying and where the limit is

If you have one product and a clear view of its components, you can start without us. Free tools can generate an SBOM, the public OSV database watches for vulnerabilities and the KEV catalog is public. A spreadsheet with contacts for the reporting people and a link to the SRP portal is enough for the first month.

The limit shows up in three places. First, proof: a spreadsheet does not record who changed the awareness time and when, nor does it lock a submitted report. The case file an authority asks for then has to be assembled by hand from e-mails. Second, substitution: a table does not notice that both SRP representatives are on holiday on Friday. Third, the number of products and versions: once you keep dozens of SBOMs, you cannot find by hand which versions a new vulnerability in a library affects.

You can try everything for free: a 14-day trial with no commitment, practice case included.

How to introduce the Cyber Resilience Act module

Start with the settings: Settings → Cybersecurity CRA → General settings. Values are saved as soon as you leave a field, and every change goes to the history. When the module is first opened, the manufacturer details are prefilled from the company card.

1. Manufacturer details: company name, address, e-mail for users and website. They are used in the EU declaration and in the information for users.
2. Article 14 reporting: the country of the main establishment (Czechia by default), the coordinating CSIRT (NÚKIB by default), company size, the decision maker and deputy, the target for the first assessment of a signal (1 to 168 hours, 24 by default) and reminders before a deadline, for example 12;4;1.
3. SRP representatives: add at least one primary and one secondary, fill in the verification date from the CSIRT and note the tested login.
4. Contact point: a separate mailbox such as security@your-domain, the CVD policy from the template and, if needed, the public form.
5. Rights: give the whole company the Read and report a suspicion level, the developers Resolve, and the consultant and the manager CRA Administration.
6. Products and SBOMs: create products, add versions and upload SBOMs. That starts the daily monitoring.

Then open the CRA Overview: the checklist shows what is still missing, and the link beside each point leads to where it can be fixed. We recommend starting the gap analysis once the products are in the register.