🧪 Annex I Part I / Part II
CRA testing and conformity assessment
Testing against the Annex I essential cybersecurity requirements, plus a process audit covering the Part II vulnerability handling requirements.
Book a free consultation →
🧪 Annex I Part I / Part II
Testing against the Annex I essential cybersecurity requirements, plus a process audit covering the Part II vulnerability handling requirements.
Book a free consultation →The technical heart of the CRA is Annex I: Part I is the product's own essential cybersecurity requirements (secure config, authentication, cryptography, attack surface, logging), Part II is the manufacturer's vulnerability handling process.
We test against Annex I item by item with a process audit, and where needed verify with penetration testing and fuzzing, producing evidence that maps to every requirement so "compliant" actually holds up.
"Nothing found" needs a reproducible test that traces to a clause.
Finding weaknesses before launch is far cheaper than a post-market report or recall.
Test results become part of the Annex VII technical documentation.
Clarify the product type, target markets and applicable clauses, and define the tests and documents needed.
Map the product's current state to the standard's requirements and produce a gap analysis.
Run the test plan and process audit; add penetration testing and fuzzing where needed.
Consolidate results and evidence, map each item to a clause, and form an auditable record.
Deliver the report and improvement recommendations; for markets that require filing, help prepare the submission.
Tell us the product type and target markets and we will come back with the applicable clauses, test scope and timeline.