Cyber Resilience Act compliance software
Acuna GRC follows each vulnerability from your scanner to a verified fix, keeps the technical documentation of your products and records what happened when one is exploited. The work you already do for NIS2 counts again.
What the CRA asks
The Cyber Resilience Act sets cybersecurity rules for products with digital elements sold in the EU, from design to the end of their support period.
Meet the essential cybersecurity requirements of Annex I, backed by a cyber risk assessment and the technical documentation of each product.
Know the components of each product, fix vulnerabilities without delay, run a coordinated disclosure policy and ship security updates.
Since 11 September 2026, report actively exploited vulnerabilities and severe incidents in stages. The other obligations apply from 11 December 2027.
Does this sound like you?
Most product teams already scan and patch. The time goes into showing which fixes happened, when, and for which product, and into rebuilding the story when a vulnerability is exploited.
Our scanner finds hundreds of vulnerabilities. Nobody can say which ones are fixed.
Fix: Each vulnerability becomes one issue with an owner and a due date set by its severity. Reminders run until the scanner reports it fixed and the owner verifies it.
See vulnerability handlingWe already run NIS2. Is the CRA a fourth silo?
Fix: No. Adopt the CRA in Comply next to NIS2. One measure counts for every framework that asks for it, so you see what is already covered.
See what is reusedWhen a vulnerability is exploited, the facts are spread across chats.
Fix: Log it as an Incident issue. Its timeline keeps dated steps, backdated if needed, with the files of each step.
See the incident timelineHow Acuna GRC covers it
Acuna GRC runs the CRA with Vulnerability management at the center: Comply sets the program, Operate holds the risks and the technical documentation, Assure keeps incidents and records, and TPRM checks the suppliers of your components.
Tenable, Qualys and Rapid7 connectors bring results in about every 4 hours, and any other scanner can send a CSV or use the API. Each vulnerability becomes one issue with an owner and a due date set by its severity. The scanner marks it fixed, the owner verifies it, and an accepted risk goes through an exception.
See Vulnerability management →Adopt the Cyber Resilience Act from the Frameworks library next to NIS2 or ISO 27001. Common Measures are mapped across frameworks, Mapping lists the CRA requirements with no measure yet, and a Product Line scope keeps each product family apart.
See Comply →Operate keeps the cyber risks of each product with their assets, threats and treatment plans. Technical documentation and your coordinated disclosure policy are Documents with an owner, approvers, numbered revisions and a yearly review.
See Operate →Log it as an Incident issue in Assure. Its timeline keeps dated steps with phase labels and the files of each step, and corrective actions carry the root cause until they are verified. Records keep the proof, such as test reports or the SBOM your own tools produce.
See Assure →TPRM keeps one supplier register. Send questionnaires one at a time or as a campaign, rate each assessment from one to three shields, and follow a daily A to F grade of each supplier’s public security posture.
See TPRM →Aiko at your pace
In Mapping, Run AI ranks the best measures from your own library for each CRA requirement with no measure, each with a confidence score and a reason. Nothing is linked until you apply it.
1Aiko proposes
2You confirm
3You set the pace
Ask Aiko whether a risk is still rated right, and it includes the open vulnerable items on the risk’s assets, with their source and date.
Admins set the highest mode for each action.
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Our experts run a Cyber Resilience Act gap assessment with your team in Acuna GRC, then help you plan the measures that are missing.
Cybersecurity governance expert
Jean-Emmanuel Rodriguez
Gap analysis and framework implementation
Legal and compliance expert
Laura Menetrey
GDPR, NIS2, DORA, FADP
GRC Consulting team leader
Bénédicte Sévin
GRC project leadershipYou run the program in Acuna GRC, with Aiko.
Guidance, reviews and audit preparation with your team.
Our experts run it. You review.
Integrations
Connectors bring in vulnerability results from Tenable, Qualys and Rapid7, dependency alerts from GitHub Dependabot and security data from your code and cloud tools, on a schedule.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
TenableQualysRapid7
Dependabot
GitHub
GitLab
Defender
AWS
Azure
Jira
ServiceNowConnectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
The CRA runs in Vulnerability management and the four core workspaces, with TPRM for your component suppliers. Add Integrations and API and Evaluations as you need them.
FAQ
It depends on what you place on the EU market and your role as manufacturer, importer or distributor. Our answer page walks through who the CRA applies to. Who does the CRA apply to?
No. You submit the report yourself. Acuna GRC keeps the incident record and its timeline, so the facts are ready when you report. CRA reporting deadlines
No. Conformity assessment and the CE marking stay with you and, where required, a notified body. Acuna GRC runs your measures and keeps the evidence. CRA conformity assessment and CE marking
No. Acuna GRC is not a scanner and does not generate SBOMs. It brings in your scanner’s results, and you keep the SBOM from your own tools as a record.
Yes. Measures are shared across frameworks, so the CRA and NIS2 link to the same measures and the same proof. NIS2 compliance software
In Switzerland, the EU or the US, as you choose.
Tell us about your products and the frameworks you already run. We show you the CRA in Acuna GRC, and how our experts can assess where you stand.
Hosted in Switzerland, the EU or the US
.png&w=3840&q=75&dpl=dpl_4WWtFHEr9P8wkcdWCGky2WYKjEiM)