02 / Compliance and certification
The Cyber Resilience Act, for products that ship with code inside
We help manufacturers read their products against the essential cybersecurity requirements, test what they ship, and set up the vulnerability handling the regulation expects for as long as the product is supported.
Overview
What the Cyber Resilience Act asks of you
The Cyber Resilience Act, Regulation (EU) 2024/2847, sets horizontal cybersecurity requirements for products with digital elements placed on the EU market: hardware and software that connect, directly or indirectly, to a device or a network. Products already covered by certain sector rules, such as medical devices or vehicles, are carved out.
The obligations fall mainly on manufacturers, with duties for importers and distributors too. Products must meet essential cybersecurity requirements by design, manufacturers must handle vulnerabilities throughout the support period, report actively exploited vulnerabilities and severe incidents, and show conformity through technical documentation, an EU declaration of conformity and the CE marking.
The obligations phase in over several years, and we work to them as they apply. Black Fox is not a notified body or a market surveillance authority. For most products the manufacturer assesses conformity itself; for some categories of important and critical products a notified body or a certification scheme is involved. We prepare you for either.
Who it is for
Manufacturers of connected hardware, software and firmware sold in the EU, including makers of IoT devices, desktop and mobile applications and virtual appliances. Also importers and distributors who need to know what to ask of the products they place on the market.
The work, from scoping to evidence.
What we do
Applicability and classification
We look at your product range and help you work out which products are in scope, your role for each one, and whether a product is likely to fall into an important or critical category.
Essential requirements gap assessment
A review of each product against the essential cybersecurity requirements, such as secure default configuration, protection of data, access control, attack surface reduction and secure updates.
Product security testing
Penetration tests and release security reviews of the product as shipped, including firmware, mobile, desktop and virtual appliance builds and the services they talk to.
Vulnerability handling
A process for receiving, triaging, fixing and disclosing vulnerabilities, a software bill of materials, and a route for the reports the regulation requires.
Technical documentation
Help with the cybersecurity risk assessment and the technical documentation that supports your declaration of conformity.
Secure development
Practical changes to how the product is built, reviewed and released, so the requirements are met by the pipeline and not by a scramble before launch.
How the engagement runs
Kickoff
We agree which products, versions and teams are in scope, and sign an NDA first if you need one.
Product mapping
We map each product's components, interfaces, dependencies and update path, and its likely classification.
Gap assessment
Documentation review, interviews with engineering and a technical look at the product, ending in a ranked gap report per product.
Testing
Security testing of the product as shipped, with business and technical reports and proofs of concept.
Process and documentation
We work with your teams on vulnerability handling, the SBOM, reporting routes and the technical documentation.
Handover and follow-up
Recommendations and a plan per product, then optional retesting of new releases as obligations apply.
What you receive
- Product scope and classification overview
- Gap assessment against the essential cybersecurity requirements
- Penetration test or release security review report
- Vulnerability handling and disclosure procedure
- Input for the cybersecurity risk assessment and technical documentation
- Prioritised action plan per product
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Are you a notified body?
No. Notified bodies are designated by member states to carry out third-party conformity assessment. We prepare your product and documentation, test it and help you respond to findings, whichever assessment route applies.
Does it apply to open-source software?
Free and open-source software that is not supplied in the course of a commercial activity is generally outside the main obligations, and the regulation has a lighter regime for open-source software stewards. If you sell a product that includes open-source components, the components are your responsibility as manufacturer.
When do the obligations apply?
They phase in. The reporting obligations apply before the rest of the requirements. Check the dates against the regulation and the guidance from the Commission. We plan the work so the parts that apply first are ready first.
Does a penetration test prove conformity?
No. Testing is evidence for some requirements, but conformity rests on the risk assessment, the design, the vulnerability handling and the documentation together. A test tells you where the product stands today.
Related services
- Advisory and responseDevSecOps and secure developmentDevSecOps from Black Fox Security: secure SDLC, threat modelling, code review, security in CI/CD, dependency and secret scanning, and developer training.
- Managed securityVulnerability managementRecurring vulnerability reviews from Black Fox Security: scanning, triage, prioritisation by exploitability and exposure, fix tracking and trend reporting.
- Offensive securityPenetration TestingPenetration testing by Black Fox Security: black, grey and white box tests against an agreed scope, business and technical reports, and a retest of your fixes.
Start with the product you ship next
Tell us what you build and how it reaches customers. We will show you where the essential requirements and your product part ways.