← Hiring CRA experts
How do you hire a security architecture reviewer for Cyber Resilience Act compliance?
Hire a reviewer with product security experience in your product type who reviews the design control by control against the Annex I essential requirements and the cybersecurity risk assessment, and delivers a written finding for each requirement.
Key takeaways
- A design review covers requirements that a penetration test checks poorly, such as secure defaults, update design, security logging and secure data deletion.
- The ISA/IEC 62443 Design Specialist and Cybersecurity Expert certificates signal industrial product security knowledge, while CISSP signals broad security management knowledge.
- An ISO/IEC 27001 audit reviews the security management of an organisation and does not replace a product design review.
- The review starts from the Article 13(2) cybersecurity risk assessment, so share the threat model before the work starts.
Last reviewed 17 October 2026
Published by Porta Regulus B.V. No paid placement. No provider is named or ranked.
Which CRA requirements does this service give evidence for?
- , security level based on the risks
- , secure by default
- , security updates
- , confidentiality of data
- , integrity of data
- , security-relevant logging
- , secure data deletion
- , secure update distribution
Which credentials should the provider hold?
| Credential | Held by | What it shows |
|---|---|---|
| ISA/IEC 62443 Cybersecurity ExpertISA (International Society of Automation) | Person | The reviewer passed all four ISA/IEC 62443 specialist certificates, including Design Specialist, for industrial automation and control systems. It is a certificate programme with no renewal. |
| CISSPISC2 | Person | The reviewer has broad security management knowledge. It does not test product design skill. |
What should you ask the provider for?
- A finding for each Annex I requirement in scope, with the evidence the reviewer read.
- The reviewer's experience with your product type, with client names removed.
- A list of the inputs the reviewer needs, such as architecture diagrams, the threat model, the SBOM and the update design.
- A review of cryptography choices, key storage and secure boot where the product has them.
- A review of the update mechanism from build to installation on the device.
Which red flags should stop the hire?
- An ISO/IEC 27001 or SOC 2 audit sold as a product review.
- A checklist with yes or no answers and no evidence references.
- A review that starts without reading the risk assessment.
Which checks apply to every CRA expert?
- Professional liability insurance that covers the work, with the amount in writing.
- Independence from your own developers and from any supplier whose component is in scope.
- A fixed price for a written scope with a defined end.
- Names and credentials of each person who does the work.
- A deliverable you may share with a notified body and a market surveillance authority.
- Data handling inside the EU, or a written basis for any transfer.
Find out which of these services your product needs
CVD Portal lists the open Annex I gaps for each product and names the kind of expert that closes each one.
This page is part of the EU Cyber Resilience Act guide, which explains Regulation (EU) 2024/2847 article by article.