Five changes are live. You can now assess each product against the Cyber Resilience Act in its own workspace, see every control in one register, give researchers a status link, and score with CVSS 4.0.
Assess each product in its own workspace
Each product with digital elements now has its own CRA workspace, with tabs in the order of a self-assessment.
- Assess. Classify the product, choose the conformity route, and build the context and the risk assessment.
- Requirements. Work through the Annex I essential requirements and draft the documents for the technical file.
- Evidence. Attach and accept the documents behind each control.
- Conformity. Generate a draft EU Declaration of Conformity, the simplified declaration and the Annex VII technical-documentation index, then download them as HTML or JSON.
You do not have to start from a blank form. Upload a manual, policy or datasheet, or paste its text. The portal proposes the product name, the CRA controls the document covers and the assets to assess. You review each proposal before anything is saved.
The generated declaration is a draft with placeholders. It is not for issuance until you complete and check it.
Where to find it: Products, then Add product or Create from a document. The product workspace is part of the Compliance plan and the free trial.
See which controls are ready for audit
The Evidence tab shows how many of the product's controls are ready for audit. A control counts when the assessment verified it, or when accepted evidence is attached and still valid. When a control is not ready, the tab tells you how to fix it.
Where to find it: Products, then open a product, then Evidence.
Track every control in one register
The new control register puts your CRA controls in one table. You can filter it, open a control to see its status and the results of its last automated checks, and assign an owner and a due date. A trend chart shows your progress over time from the day the register started to collect data.
Some controls are now checked automatically. For example, a reporting channel that has expired or a known-exploited component in your SBOM turns the matching control red after its next check.
Administrators can assign owners and dates. Members can read the register.
Where to find it: Controls, in the CRA compliance section of the sidebar.
Give researchers a reference and a status link
When a researcher submits a report through your portal, they now receive a reference number and a private status link. If they give an email address, they also get a confirmation email with both. The status page shows where the report is, from Received to Acknowledged, In progress and Resolved. It never shows your internal notes or contact details.
You can also credit the researcher on a published advisory. Enter their name or alias, and confirm that they agreed to public credit. The credit then appears on the advisory page and in the CSAF export. Without that confirmation, it stays private.
Where to find it: Submissions, then open a report, then Public Advisory.
Score with CVSS 4.0
The CVSS calculator on each report now supports CVSS 4.0 next to CVSS 3.1. Select the version at the top of the calculator. When you open a report that has a saved vector, the calculator selects the correct version for you.
Where to find it: Submissions, then open a report, then CVSS Calculator.
Also new
You can turn on two-factor authentication for password sign-in. Use an authenticator app, and keep the backup codes it gives you. An administrator can also download all company data as HTML, CSV or JSON, on any plan. Both are in the workspace menu, under Account details.
What has not changed
Your existing reports, scores and readiness figures were not moved or re-scored. Vectors you saved in CVSS 3.1 stay in CVSS 3.1.
Completing a self-assessment in the portal is not a conformity assessment or evidence of lawful CE marking. This note is not legal advice.