CRA Scan

Is your cyber security in order and do you meet the European rules?

You think your device meets the Cyber Resilience Act, but you are not sure. In the scan we look at your implementation with you. You get a report with the risks and what to improve first.

Request the scan Start with the free check

Sound familiar?

  • The CRA check gave you a lot of "I don't know", or you doubt your answers
  • Your devices are already in the field and you don't know what can still be changed
  • A customer or distributor asks whether you comply with the CRA
  • You don't know which product category applies, so you don't know which assessment you need
  • Since 11 September 2026 actively exploited vulnerabilities must be reported within 24 hours, and nobody has picked that up yet

Then a CRA Scan helps.

Where does the scan fit?

CRA check

Free

  • You answer the questions yourself
  • Your points of attention right away
  • Improvement guide on request
Start the check →

CRA Scan

€3,450 excl. VAT

  • We check your implementation
  • Every finding with evidence and priority
  • Report and a walkthrough with your team
Request the scan →

Improve

Quoted per project

  • We fix the findings together with your team
  • From signed updates to SBOM and provisioning
  • In your own stack or with sensor-link
More about sensor-link →

What we look at

Classification

Whether your product falls under the CRA, in which category, and which conformity route applies.

Connection and identity

How devices log in, whether they verify the server, and whether you can block a single device.

Keys and credentials

Where keys are stored, how they get onto the device, and whether the debug and serial ports are closed.

Firmware updates

Rollout, signature verification, interrupted updates and rolling back to older versions.

Product and process

SBOM, vulnerability handling, reporting duty, support period, default passwords and logging.

Processes and documentation

How you develop, test and fix vulnerabilities, and which CRA documentation already exists.

What you get

  • The classification of your product and the conformity route
  • A verdict with evidence for every point in the CRA check
  • What is still missing in processes and documentation
  • The risks in order of priority
  • Concrete steps for each finding and the matching CRA article
  • A walkthrough of the results with your team

You see what we actually checked

Verified
We saw it ourselves.
Stated
Your team told us, but we could not see it.
Not shown
We received no evidence for this.
Example of a finding

3.2 Update authenticity

CRA Annex I, Part I (2)(f), Part II (7)

Risk Verified Priority 1
What we saw
The bootloader only checks a CRC. A modified firmware image gets installed without complaint.
Why it matters
Anyone who reaches the update channel can put their own firmware on all your devices.
What you can do
Sign every image and have the bootloader verify the signature before it boots. Keep the signing key off your build server.

How does it work?

  1. 1

    You request the scan

    If you filled in the free check, your answers come along. That tells us right away where to start.

  2. 2

    We set the scope

    We agree on the product and firmware version, and on who your technical contact is. If you want, we sign an NDA first.

  3. 3

    You collect the evidence

    Using a list, we tell you exactly what information we need.

  4. 4

    You show us

    In a two-hour session your engineer shares their screen and walks us through the code, configuration, infrastructure and processes.

  5. 5

    We write the report

    There is one round of follow-up questions.

  6. 6

    We go through the results

    We go through the findings with your team and decide what should be tackled first.

What we need from you

Your source code stays with you. You show it during the session and don't have to send anything from your repository.

Connection and identity

  • Architecture diagram
  • How devices authenticate
  • Broker access rules

Keys and credentials

  • How devices are provisioned
  • Microcontroller type
  • Debug port and readout protection settings

Firmware updates

  • Description of the OTA flow
  • One signed firmware image
  • How the bootloader verifies it

Product and process

  • SBOM or dependency lockfiles
  • Vulnerability procedure
  • Security contact and support period
  • How you develop, test and release
  • Existing CRA documentation

What we never want to receive

Private keys, signing keys, production passwords and customer data. We agree at the start how your materials are stored and deleted.

Price

€3,450 excl. VAT

fixed price per product

Conditions:

  • One product and one firmware version
  • One round of follow-up questions
  • We start once the evidence has arrived

Several products or variants? We make you a custom quote. The scan is not legal advice, a conformity assessment or a penetration test. A full code audit is quoted separately.

Why Jitter?

We build connected products ourselves. In sensor-link we had to solve per-device identity and signed updates ourselves. You talk to the engineers who do this every day and who look at hardware, firmware and server together.

Frequently asked questions

Do I have to send you my source code?
No. Your engineer shows the code during a screen-sharing session. If you prefer to give us repository access, that works too. We never want to receive private keys or signing keys.
Is the CRA Scan a conformity assessment?
No. The scan shows where you stand and what still needs doing. The conformity assessment and the EU declaration of conformity remain the manufacturer's responsibility. Some product categories need a notified body for this. The scan tells you which category applies.
My product is still in development. Is the scan useful yet?
Yes. A secure element or a secure bootloader is much easier to add before the architecture is fixed or the first batches are produced.
Do I have to do the free CRA check first?
No, but it helps. If you fill in the CRA check first, you can include your answers and we know right away where to start.

Request the scan

We get in touch to discuss your product and the approach. You are not committing to anything yet.

Not filled in yet? Do the free check first and your answers come along automatically.

We only use your details for this request.