Building One Scalable CRA Compliance Capability Across a Large Product Portfolio

Our Approach & Solution

The program began with an onsite headquarters workshop bringing together product, engineering, IT, legal, compliance, and security stakeholders. Nemko Digital mapped CRA obligations to the manufacturer's workflows, assessed the current state, and established a roadmap. Practical applicability and categorization decision trees helped teams determine scope, identify likely conformity routes, and flag products needing deeper validation. The assessment placed the portfolio in the CRA default-category self-assessment route.

Nemko Digital then designed a CRA Vulnerability Reporting Standard, adapting the company's existing IT security standards to product-security and CRA requirements. The standard defined roles, decision rights, escalation paths, coordinated vulnerability disclosure, public reporting channels, and Article 14 reporting logic. It also covered 24-hour, 72-hour, and final-report workflows for the ENISA Single Reporting Platform, combining central governance with workstream-level ownership.

The work was integrated into the client's existing version-control, documentation, collaboration, and secure-access environments. Hands-on sessions established consistent vulnerability and incident records covering affected products and components, impact, exploitation status, evidence, remediation, reporting milestones, and user communication. Workshops, tabletop exercises, and reporting-path rehearsals began testing whether the roles, decisions, and evidence would work under time pressure.

Consolidated records exposed gaps in monitoring, ownership, evidence quality, escalation, and remediation tracking. They also provided practical input for product cybersecurity risk assessments and continued work toward the broader CRA requirements applying in 2027. A parallel EU Data Act work package aligned governance, resources, and timelines while keeping each regulation's scope and deliverables separate.