Our IoT engineers assess your connected products against the CRA’s technical requirements and hand over a gap report, an SBOM baseline and a remediation roadmap — the technical evidence your legal counsel needs.
WebbyLab’s CRA Technical Readiness Assessment is an engineering review of connected products against the technical requirements of the EU Cyber Resilience Act (Regulation (EU) 2024/2847). It covers device firmware, update mechanisms, cloud and mobile apps, and the SBOM, and produces the technical evidence your legal counsel uses for the conformity process.
Manufacturers must report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours. This also applies to products that are already on the market.
Every unit placed on the EU market from this date must meet the CRA’s essential requirements in full, even if the model has been sold for years.
Is this you?
Manufacturers and brands of connected devices for the EU market — HVAC and heat pumps, industrial equipment, smart home — including brands that sell OEM hardware under their own logo.
Units already in the field don’t have to be reworked. But every unit you sell after 11 December 2027 must meet the requirements in full, even if the model is years old. You need to know what has to change before then.
Your supplier’s CRA answers are incomplete or contradict each other. You can’t show compliance your supplier can’t evidence.
Anything placed on the market from 11 December 2027 must comply from day one. You want the security requirements designed in, not patched in before release.
A distributor or a key account wants evidence of CRA readiness, and you need a technical answer you can stand behind.
Scope
Seven technical areas that cover the essential requirements in Annex I of the CRA, plus an eighth for products built on OEM hardware.
Secure boot, exposed debug ports and interfaces, default and shared credentials, secure-by-default configuration and factory reset.
OTA mechanism, update signing and integrity checks, rollback protection, and automatic security updates that are on by default and can be switched off by the user.
Encryption on every channel, MQTT included, per-device credentials, and how devices authenticate to your cloud.
The CRA covers cloud services and apps only where you develop them, or they are developed under your responsibility, and the product needs them to work. We assess that part — access control, data protection, attack surface — and mark what falls outside.
Data minimisation, encryption of stored and transmitted data, logging of security-relevant events, and secure deletion of user data and settings.
An inventory of components and third-party libraries, known vulnerabilities, and version drift across the fleet.
A coordinated vulnerability disclosure policy and a contact point for reports, the process to triage, fix and report vulnerabilities, security updates through the support period, and a declared end-of-support date.
We cross-check supplier questionnaires, specifications and the device’s actual behaviour, and lead the technical dialogue with the supplier’s engineers on your behalf.
Where deeper testing is worth doing, the roadmap says so.
Deliverables
For each product line:
The core CRA document: a threat model for your product and a matrix showing which Annex I requirements apply to it and why. Everything else in the report builds on it.
Each applicable requirement marked as met, partly met, not met or not assessed, with severity and the evidence behind it.
A software bill of materials in SPDX or CycloneDX format, ready to maintain release by release.
Technical notes on your update architecture and device identity: what works and what to change.
Prioritised fixes with effort estimates, so you can plan the engineering work.
The technical material that goes into your product’s technical documentation.
A short summary for management: where each product stands and what it will take.
Every supplier source checked against every requirement, with gaps and contradictions flagged.
The documents to obtain from your supplier — module and firmware versions, update signing and root of trust, secure boot, a sample SBOM, architecture and threat model, vulnerability handling policy, a plan to December 2027 — and the technical commitments for the supply contract: support period, 24-hour notice, fix timelines, an SBOM with every release. The contract terms themselves stay with your legal counsel.
The assessment is not a declaration of conformity or legal advice.
Process
We agree which products are in scope, what we can access and what we need from you.
We map product lines, firmware versions, components and dependencies, and build the SBOM baseline.
We review each area against the CRA’s technical requirements and record findings with evidence.
We hand over the report and walk through it with your team and your legal counsel.
Roles
Your counsel decides what the CRA requires of you. We show what your products actually do — and what to change.
For OEM products: we talk to your supplier’s engineers; your counsel negotiates the supply terms.
Case studies
The same engineering team builds and maintains firmware, OTA and cloud platforms for connected equipment.
SmartHeat
A heat pump manufacturer’s existing ESP32 firmware connected to a cloud platform for remote control, diagnostics and telemetry, without rebuilding it from scratch.
Paton
ESP32 bridge firmware and a mobile app that deliver firmware updates to STM32 controllers in the field, built to withstand electromagnetic interference from welding.
MyBox
Real-time MQTT connectivity, an OCPP-compatible architecture, a driver app and an operator admin panel, with a full monitoring stack.
ISO 9001
Offices in London and Kyiv
Next steps
No obligation to continue with us. If you want help with the fixes, these are the usual next steps.
Close the gaps in existing firmware and add a secure update path for devices already in the field.
Move off a locked vendor cloud to a platform you own, with security designed in.
A ready platform for connected HVAC and heat pumps: firmware, cloud, app and OTA.
Your expert
Head of IoT, WebbyLab
Kostiantyn was the first member of WebbyLab’s IoT department and grew it into a practice that covers embedded and hardware development alongside cloud and mobile software. His background is in telecommunication systems engineering.
FAQ
No. It’s a technical engineering assessment that prepares the evidence for one. The conformity assessment, the EU declaration of conformity and CE marking stay with you and your legal counsel. The assessment is not a declaration of conformity or legal advice.
A list of the products in scope, firmware versions, source code or binaries, available technical documentation, test devices and a technical contact on your side. For OEM hardware, also the CRA answers and specifications you’ve received from the supplier. We send the exact list after the scoping call.
Preferably, yes: source code gives the most complete picture. If you don’t have it, we agree the scope for your case, and the report states clearly what was and wasn’t assessed.
Yes — the scope depends on your case. Depending on what we can access — source code, binaries, OEM documentation or only the device and its cloud connection — we agree the scope at the scoping call, and the report states clearly what was and wasn’t assessed. For OEM products we also review your supplier’s answers and specifications, flag gaps and contradictions, and can lead the technical dialogue with the supplier’s engineers.
Yes, where they fall under the CRA. The regulation covers cloud services and apps only if they are developed by you or under your responsibility and the product needs them to work. We assess that part alongside the firmware, and the report states what is out of scope.
Yes. We cover the engineering side and work alongside your legal counsel or compliance team; we don’t provide legal services.
You get the report, the SBOM and the roadmap, and we walk through them with your team and your counsel. You can then fix the issues in-house, with another partner or with us. No obligation to continue with us.
Get started
Tell us about your products. In 30 minutes we’ll agree the scope, what we need from you and a realistic timeline.
© 2026 WebbyLab LLC. All rights reserved.
