What the CRA actually requires of your firmware
The thirteen essential requirements, in plain terms, and what each one means for the code on the device.
Coming soonWe build the firmware security, updates and evidence the EU Cyber Resilience Act requires, so you ship on time without hiring a security team you can’t find.
We build the engineering. The evidence comes from your build, not from a form.
CRA reporting obligations begin on 11 September 2026; the main obligations follow on 11 December 2027. PSTI and the RED security rules already apply today. The firmware is the gap most teams close last.
What this means for you →Actively exploited vulnerabilities must be reported within 24 hours from this date.
Some teams want it done, some want to own it, some want to learn it. The two-minute check points you to yours.
A fixed-price assessment of where you stand, then we build what’s missing and hand over an audit-ready technical file.
Point Firmproof at the build you already produce: it generates the SBOM, watches your components, and assembles the evidence as you work.
The Academy teaches the builder’s side of embedded security: the same mechanisms we deliver in real engagements, taught as they’re built.
Whichever path you take, the same discipline stands behind it.
The CRA’s essential requirements, implemented rather than approximated, in your codebase rather than a slide deck.
Every deliverable maps to what a notified body or test lab expects to see: the technical file, the traceability, the test reports.
The discipline of the industry with the least tolerance for firmware that fails, brought to your connected product.
Short, specific write-ups from the build: answer first, sources cited.
The thirteen essential requirements, in plain terms, and what each one means for the code on the device.
Coming soonA real walkthrough: from build metadata to a machine-readable bill of materials you can actually maintain.
Coming soonLessons from safety-critical automotive software, and why connected products are about to learn them.
Coming soonTwo minutes tells you where you stand. The rest becomes a plan.