Blog

GRC insights, framework guides, and practitioner perspectives.

Featured

"We're out of scope" is not a CRA answer

Medical devices, vehicles, aviation, marine equipment, spare parts and non-commercial open source are excluded from the Cyber Resilience Act. Every one of those exclusions is narrower than it reads, and none of them touch your NIS2 duties.

10 August 2026

procedural

The CRA lands on your procurement desk too: what to ask your suppliers

The Cyber Resilience Act regulates manufacturers, not the organisations that buy from them. What you can legitimately ask suppliers before December 2027, the ten questions that get substantive answers, and the contract clauses worth having now.

10 August 2026