CRA and NIS2

What your firmware says about the CRA and § 30 BSIG

The report maps every finding to a requirement from CRA Annex I or § 30 BSIG (Germany's NIS2 implementation), and every result names the check it comes from. Traceable technical evidence for internal reviews, audits and the manufacturer's documentation.

Free CRA readiness checkSee the catalogue

As of 20 October 2026 · Cyber Resilience Act, Regulation (EU) 2024/2847 · BSIG as amended by the NIS2UmsuCG

Compliance view of the app for CRA Annex I: for each point the result, its basis and its form, for example Part I point (2)(a) as a finding with 4 critical and 51 high vulnerabilities in 156 components, points (b) and (d) with the account that has no password
Industrial gateway · OpenWrt 23.05.5 · Compliance tab, CRA Annex I (the app is in German) · public firmware image (x86-64), analysed 22 October 2026; not a conformity verdict
7
points answered by the analysis from the shipped image itself
2
counted from the component inventory
23
listed in the report by number, mapped to your documentation
32
in total across both rulesets, counted at runtime

The catalogue

What the image answers, and what it does not

Every point sits in one of three lanes: from the image, from the inventory, in your documentation.

from the image
from the inventory
in your documentation
CountCRA Annex I§ 30 BSIGTotal
Points221032
from the image527
counted112
in your documentation16723
Three lanes, width by count; below, the split per ruleset, which adds up to the key figures above.
7 of 32 from the image
The analysis reads the evidence from the image: package versions, password hashes, keys, certificates, binary hardening, network-capable components.
2 of 32 counted
The analysis counts the components the image carries: the bill of materials, the supply chain. The result is a number, with no verdict attached.
23 of 32 in your documentation
Policies, processes, reporting channels, updates. The report lists them by number, so no point is left without a line in the audit.

A point the image cannot answer never counts as passed. The report gives counts per ruleset and no percentage.

Quelle: The product's catalogue, two rulesets · identifiers and assessment type as printed in the report · counted at runtime, as of 18 September 2026

The division of work

Who carries what: the analysis, the manufacturer, the entity

7points the analysis answers

  • For five requirements from Annex I Part I, and for no. 5 and no. 8 of § 30(2) sentence 2 BSIG, the report states a result, each with the check it comes from and the section that holds the raw findings.
  • It reads the bill of materials required by Annex I Part II no. 1 from the image, as CycloneDX 1.6 or SPDX, and counts it for § 30 no. 4.
  • A point a check did not reach carries the reason from the check log: no Linux root file system in the image, no package database, hardening check not executable.
  • Annex VII, point (6) requires test reports on the requirements of Annex I. The report maps every result to its number in Annex I, with the form of the result.

16points you declare as the manufacturer

  • The conformity assessment procedure that applies to your product, and the EU declaration of conformity.
  • The notification under Art. 14.
  • The documentation for the sixteen points on policy, process and reporting channel that the report lists by number.

7numbers your entity documents as the operator

§ 30(1) sentence 2 BSIG requires the entity to document that it meets the obligations. The report is such a document, with date and scope of the check. The proof under § 39 rests on an audit by an auditing body; the report is the documentation you present to it.

You make the conformity statement. You keep the report.

Per ruleset

Every point, with its identifier

No excerpt. The full catalogue as the report lists it, sorted by what the image can say about each point: CRA Annex I 22 points, § 30 BSIG 10 points.

CRA Annex I

22 points · Annex I of Regulation (EU) 2024/2847, Part I and Part II

Cyber Resilience Act, Annex I · Products with digital elements, manufacturer obligations

The essential cybersecurity requirements of Regulation (EU) 2024/2847: Part I covers the properties of the product, Part II vulnerability handling. Reporting obligations have applied since 11 September 2026, the full manufacturer obligations apply from 11 December 2027. From the image, the analysis answers five requirements and gives a count for one; the report lists the remaining sixteen by number, mapped to the manufacturer's technical documentation.

11 September 2026
Reporting obligations under Art. 14
11 December 2027
Full manufacturer obligations, including Annex I and SBOM
22 points with identifier, 5 from the imageShow

from the image5

  • I-2-aMade available without known exploitable vulnerabilities
  • I-2-bSecure by default configuration
  • I-2-dProtection from unauthorised access
  • I-2-eConfidentiality of stored, transmitted and processed data
  • I-2-kExploitation mitigation mechanisms

from the inventory1

  • II-1Identify components and vulnerabilities, including a bill of materials

in your documentation16

  • I-1Design, development and production appropriate to the risks
  • I-2-cVulnerabilities addressed through security updates
  • I-2-fIntegrity of data, programs and configuration
  • I-2-gData minimisation
  • I-2-hAvailability of essential functions
  • I-2-iLow impact on other devices and networks
  • I-2-jLimited attack surfaces
  • I-2-lRecording of security-relevant activity
  • I-2-mSecure removal of data and settings
  • II-2Remediate vulnerabilities without delay
  • II-3Regular security tests and reviews
  • II-4Disclosure of fixed vulnerabilities
  • II-5Policy on coordinated vulnerability disclosure
  • II-6Sharing information on vulnerabilities, and a contact address
  • II-7Secure distribution of updates
  • II-8Security updates without delay and free of charge

Relevant for: Device manufacturers, importers and distributors in the EU

§ 30 BSIG

10 points · § 30(2) sentence 2 nos. 1 to 10 BSIG

§ 30 BSIG, risk management measures · Particularly important and important entities

The ten numbers of § 30(2) sentence 2 BSIG (the BSI Act as amended by Germany's NIS2 Implementation Act (NIS2UmsuCG), in force since 6 December 2025). The obligation falls on the entity. From the image, the analysis answers two numbers and gives a count for one; the report lists the remaining seven by number, as measures of the entity.

10 points with identifier, 2 from the imageShow

from the image2

  • Nr. 5Security in acquisition, development and maintenance, including vulnerability management
  • Nr. 8Use of cryptography

from the inventory1

  • Nr. 4Supply chain security

in your documentation7

  • Nr. 1Policies on risk analysis and information security
  • Nr. 2Handling security incidents
  • Nr. 3Business continuity and crisis management
  • Nr. 6Assessing the effectiveness of risk management measures
  • Nr. 7Training and awareness
  • Nr. 9Personnel security, access control and management of ICT systems
  • Nr. 10Multi-factor authentication and secured communication

Relevant for: Entities from Annex 1 and 2 BSIG with 50 or more employees, or with annual turnover and annual balance sheet total each above EUR 10 million; operators of critical facilities always

The first question

What a head of development asks first

Why does the report show no percentage?
Because a percentage hides the base. For each ruleset, the report states how many points the analysis reached a result on, for example “6 findings in 10 checked points”. A point that was not checked carries its reason. A score that gives such a point half credit turns uncertainty into fulfilment.
What happens to a point the image cannot answer?
It never counts as passed. Policies, processes and reporting channels are not in the image; the report lists them as the manufacturer's technical documentation or as a measure of the entity. The absence of a finding is never turned into fulfilment.
Is this a conformity verdict?
No. The report is technical evidence per point, with identifier, result and basis. The conformity verdict is made by the assessor, the auditor or the manufacturer in their own procedure. For that, they get the evidence in a form they can check for themselves.

Example analysis

How the report prints the results

The mapping runs during the firmware analysis, with no second pass. Every point carries a result in one of five forms, and its basis; crypto findings are also classified against BSI TR-02102-1. The technical findings report carries the same lines as technical evidence for internal reviews and audit preparation.

  • Five forms per result: finding, checked without finding, not checked with reason, observation, not determinable from the image
  • The reason for every point not checked, from the analysis log
  • Technical findings report with the same line per point

Page 36 of 38, reference to CRA Annex I

Technical findings report, page 36, section 15: reference to CRA Annex I, the first three requirements (Part I point (2)(a), (b) and (d)) with the result and the limit of what it states
Technical findings report (in German) on the public firmware image OpenWrt 23.05.5 x86-64, exported from the app on 22 October 2026: the first three lines of the section.

Deadlines and obligations

What the CRA requires of manufacturers, and when

The dates and obligations that matter for firmware, with their legal reference. Checked on 20 October 2026 against the German text in the Official Journal.

  1. 10 December 2024

    In force

    Twenty days after publication in the Official Journal.

  2. 11 September 2026

    Reporting obligation, Art. 14

    Also for devices already on the market (Art. 69(3)).

  3. 11 December 2027

    All requirements

    Annex I, SBOM, CE marking (Art. 71(2)).

  • SBOM

    A software bill of materials in a commonly used, machine-readable format, covering at least the top-level dependencies (Annex I, Part II, point (1)).

  • Support period

    A support period of at least five years, unless the product is expected to be in use for a shorter time (Art. 13(8)).

  • Devices already on the market

    A device placed on the market before 11 December 2027 only has to meet the requirements if it is substantially modified afterwards (Art. 69(2)). The reporting obligation applies regardless (Art. 69(3)).

  • Fines

    For infringements of Annex I, Art. 13 or Art. 14: up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher (Art. 64(2)).
Cyber Resilience Act, Regulation (EU) 2024/2847, Art. 13, 64, 69, 71.

Art. 14(1) and (2)

Reporting obligation for an actively exploited vulnerability

24hours
Early warning notification, after you become aware of the exploited vulnerability
72hours
Vulnerability notification with the product, the nature of the exploitation and the corrective or mitigating measures taken
14days
Final report, after a correction or mitigation is available

The notification goes simultaneously to the CSIRT designated as coordinator and to ENISA. To report, you first need to know which shipped releases contain the affected component: the bill of materials per release.

Cyber Resilience Act, Regulation (EU) 2024/2847, Art. 14(1) and (2). Checked on 20 October 2026.

Further reading

Technical evidence for your firmware

For every point from CRA Annex I and § 30 BSIG, the report states what your image says about it, and where action is needed.

Free CRA readiness checkBook a call