The Product Cybersecurity Group

Annex I readiness

How ready is your product for CRA Annex I?

Score 16 product security and vulnerability-handling practices. The output is a gap-screening aid, not a legal compliance assessment. Rules last reviewed 2026-10-19 by Tyson Benson.

Answer all 16 questions. Yes = 2, Partly = 1, No / Don't know = 0. This self-assessment is a planning aid, not a compliance determination.

Part I — Product security requirements

  1. 1. Is the product delivered with no known exploitable vulnerabilities?

    Annex I, Part I, point 2(a)

    Is the product delivered with no known exploitable vulnerabilities?

  2. 2. Does it have a secure-by-default configuration, including a reset to the original state?

    Annex I, Part I, point 2(b)

    Does it have a secure-by-default configuration, including a reset to the original state?

  3. 3. Are security updates available, automatic by default with an opt-out?

    Annex I, Part I, point 2(c)

    Are security updates available, automatic by default with an opt-out?

  4. 4. Does the product protect against unauthorised access through authentication and access control?

    Annex I, Part I, point 2(d)

    Does the product protect against unauthorised access through authentication and access control?

  5. 5. Is confidentiality of stored and transmitted data protected, for example through encryption?

    Annex I, Part I, point 2(e)

    Is confidentiality of stored and transmitted data protected, for example through encryption?

  6. 6. Is the integrity of data, commands, programs and configuration protected?

    Annex I, Part I, point 2(f)

    Is the integrity of data, commands, programs and configuration protected?

  7. 7. Does the product minimise the amount of data it processes?

    Annex I, Part I, point 2(g)

    Does the product minimise the amount of data it processes?

  8. 8. Are essential functions available and resilient, including mitigation of denial-of-service attacks?

    Annex I, Part I, point 2(h)

    Are essential functions available and resilient, including mitigation of denial-of-service attacks?

  9. 9. Is the attack surface limited, including external interfaces?

    Annex I, Part I, point 2(j)

    Is the attack surface limited, including external interfaces?

  10. 10. Does the product provide security logging and monitoring with a user opt-out?

    Annex I, Part I, point 2(l)

    Does the product provide security logging and monitoring with a user opt-out?

  11. 11. Can users securely and easily delete their data and settings?

    Annex I, Part I, point 2(m)

    Can users securely and easily delete their data and settings?

Part II — Vulnerability handling

  1. 1. Is there a machine-readable SBOM covering at least top-level dependencies?

    Annex I, Part II, point 1

    Is there a machine-readable SBOM covering at least top-level dependencies?

  2. 2. Is a coordinated vulnerability disclosure policy published with a contact address?

    Annex I, Part II, points 5–6

    Is a coordinated vulnerability disclosure policy published with a contact address?

  3. 3. Are security tests and reviews performed regularly?

    Annex I, Part II, point 3

    Are security tests and reviews performed regularly?

  4. 4. Is there a secure mechanism for distributing product updates?

    Annex I, Part II, point 7

    Is there a secure mechanism for distributing product updates?

  5. 5. Are security updates free, accompanied by advisories, and fixed vulnerabilities publicly disclosed?

    Annex I, Part II, points 4 and 8

    Are security updates free, accompanied by advisories, and fixed vulnerabilities publicly disclosed?