EU Cyber Resilience Act Toolkit
A product-security playbook for manufacturers, importers and distributors of products with digital elements who must meet the Cyber Resilience Act.
The playbook is typically around 65 files in 13 numbered folders, with a README that maps every file. Excel workbooks are about 60 percent and PDF guides about 40 percent. Exact file names and the mix inside each folder vary with your role and situation.
The playbook is prepared by Gerard Blokdyk for your role and situation after you buy. Access is within 24 hours. The purchase is one time and carries a 30-day refund.
What you get
13 numbered folders and a README that maps every file, prepared for your role and situation. It is a playbook, not training, and it does not include a certificate.
Who it is for
For product security, engineering and compliance leads who own the technical file, vulnerability handling and CE marking.
The 12 areas
Area 1. Scope and products
- Classify every product against Annex I
- Identify the economic operator role
- Check the open-source and free software position
- Map the dates that apply
Area 2. Essential cybersecurity requirements
- Set an appropriate level of cybersecurity based on risk
- Ship with no known exploitable vulnerabilities
- Use secure by default configuration with a reset
- Protect against unauthorised access and report it
Area 3. Data and availability
- Protect confidentiality of stored, transmitted and processed data
- Protect integrity of data, commands, programs and configuration
- Minimise data
- Keep essential functions available after an incident
Area 4. Vulnerability handling
- Identify and document vulnerabilities and components
- Maintain a software bill of materials
- Remediate without delay
- Keep security updates separate from feature updates
Area 5. Testing and disclosure
- Test and review security regularly
- Disclose fixed vulnerabilities
- Publish a coordinated vulnerability disclosure policy
- Provide a contact address for vulnerability reports
Area 6. Updates and support
- Distribute updates securely
- Provide security updates without delay and free of charge
- Issue advisories
- Document the support period
Area 7. Technical documentation
- Describe the product and its intended purpose
- Document the design, development and architecture
- Document the vulnerability handling process
- Keep the risk assessment and test reports
Area 8. Conformity assessment
- Use Annex VIII procedure A internal control where it applies
- Prepare a Annex VIII procedure B EU-type examination
- Use Annex VIII procedure C conformity to type
- Operate a Annex VIII procedure H quality system where required
Area 9. Declaration and CE marking
- Draft the EU declaration of conformity
- Use the simplified wording where allowed
- Affix CE marking under the rules
- Keep the declaration and technical file
Area 10. User information
- Give the manufacturer identity and contact
- Give the vulnerability contact and policy location
- Give the unique product identification
- Explain secure commissioning, updates and decommissioning
Area 11. Market surveillance
- Cooperate with competent authorities
- Keep the technical file ready
- Take corrective action and fix the system
- Respond to substantiated concerns
Area 12. Reporting and dates
- Prepare vulnerability and incident reporting under Article 14
- Meet the 11 September 2026 reporting date
- Meet the 11 December 2027 general date
- Meet the 11 June 2026 conformity assessment body date
Dates that matter
- 11 September 2026: CRA reporting obligations apply (CRA source export).
- 11 December 2027: the general application date (CRA source export).
How it works
The playbook is prepared by Gerard Blokdyk for your role and situation after you buy. Access is within 24 hours. The purchase is one time and carries a 30-day refund.