← Hiring CRA experts
How do you hire a penetration tester for Cyber Resilience Act compliance?
Hire a firm that tests the whole product, including firmware, hardware interfaces and the companion app, maps each finding to the Annex I essential requirements, includes a retest, and shows a sample report before you sign.
Key takeaways
- No credential makes a penetration test CRA compliant, and no CRA-specific pentest credential exists.
- CREST accreditation signals a vetted company, while CREST CRT or CCT, OSCP or GIAC GPEN signals the skill of the individual tester sent to you.
- and need robustness and fuzz testing, which many standard pentest quotes leave out.
- A pentest report is evidence for , regular security testing, so plan a repeat test for each major release.
Last reviewed 17 October 2026
Published by Porta Regulus B.V. No paid placement. No provider is named or ranked.
Which CRA requirements does this service give evidence for?
- , no known exploitable vulnerabilities
- , protection from unauthorised access
- , availability of essential functions
- , impact on other devices and networks
- , limited attack surfaces
- , exploitation mitigation
- , regular security testing
Which credentials should the provider hold?
| Credential | Held by | What it shows |
|---|---|---|
| CREST Accreditation (Penetration Testing)CREST | Company | The company passed CREST's assessment of its testing methods and quality controls. It does not require the testers to hold CREST qualifications. |
| CREST Registered Penetration Tester (CRT) and CREST Certified Tester (CCT INF or CCT APP)CREST | Person | The tester passed a practical CREST exam. CCT is the senior level, for infrastructure (INF) or applications (APP). |
| OffSec Certified Professional (OSCP and OSCP+)OffSec | Person | The tester passed a hands-on exam that requires exploiting live machines. OSCP+ expires after 3 years unless renewed, so it shows recent practice. |
| GIAC Penetration Tester (GPEN)GIAC | Person | The tester passed an exam on penetration testing methods. |
| ISO/IEC 17025:2017 accreditationNational accreditation body under Regulation (EC) 765/2008 | Laboratory | The test laboratory is competent and impartial for the accredited test methods only. Check the scope on the certificate. |
What should you ask the provider for?
- A scope that lists every interface, including network services, radio, debug ports such as UART and JTAG, the cloud API and the mobile app.
- A named test method, for example the OWASP IoT Security Testing Guide or the OWASP Firmware Security Testing Methodology.
- For consumer IoT, tests against ETSI EN 303 645 V3.1.3 using the ETSI TS 103 701 test specification.
- Robustness and fuzz testing of network protocols for and .
- A finding table that maps each result to the Annex I requirement it affects.
- A retest of fixed findings inside a stated time, included in the price.
- A sample report from an earlier engagement, with client details removed.
Which red flags should stop the hire?
- A quote that calls the test a "CRA certified pentest" or promises a CRA compliance result.
- A web application scope for a product that ships as a device.
- An automated vulnerability scan sold as a penetration test.
- No retest, or a retest priced only after the report arrives.
- Report terms that stop you from giving the report to a notified body or an authority.
Which checks apply to every CRA expert?
- Professional liability insurance that covers the work, with the amount in writing.
- Independence from your own developers and from any supplier whose component is in scope.
- A fixed price for a written scope with a defined end.
- Names and credentials of each person who does the work.
- A deliverable you may share with a notified body and a market surveillance authority.
- Data handling inside the EU, or a written basis for any transfer.
Find out which of these services your product needs
CVD Portal lists the open Annex I gaps for each product and names the kind of expert that closes each one.
This page is part of the EU Cyber Resilience Act guide, which explains Regulation (EU) 2024/2847 article by article.