Article 13Annex IFree
SME Cyber Resilience Maturity Assessment
Rate your product security practice across 25 questions in 5 domains. Get a maturity score, a RAG breakdown and a tailored CRA improvement checklist. Nothing stored on our servers.
Free Developer & Compliance Tools
CVD & CRA Tools
Interactive tools to calculate CVSS scores, generate security.txt, track Article 14 deadlines, and assess your CRA readiness.
Use →
Article 3Article 24Article 14Free
Manufacturer or open-source software steward?
Work out which CRA role you hold for an open-source project. Applies the Article 3(48) test, the monetisation tests from Commission guidance C(2026) 5252, and the graduated Article 24(3) reporting duties. Nothing stored on our servers.
Article 14Free
Article 14 Deadline Calculator
Enter the date and time you became aware of an actively exploited vulnerability or severe security incident. Get your exact Article 14 notification deadlines for ENISA reporting.
Article 13Article 14Annex IFree
CRA Vulnerability Disclosure Readiness Check
A 20-question check of your readiness to handle and report vulnerabilities under CRA Articles 13 and 14. Focused on coordinated disclosure, 48-hour acknowledgment, ENISA reporting and advisories. For a whole-programme view across all five CRA domains, use the CRA Maturity Assessment.
Annex IFree
CSAF 2.0 Advisory Validator
Paste your CSAF 2.0 JSON advisory and instantly validate the structure against the OASIS CSAF 2.0 schema. Identifies missing mandatory fields, invalid values, and flags common issues that would cause rejection by automated consumers and ENISA tooling.
Article 13Article 14Free
CVD Policy Generator
Build a complete, publication-ready CVD policy document using a guided five-step wizard. Configure your response timelines, CRA Article 13 and 14 obligations, and product scope, then export a finished Markdown policy you can publish immediately.
Article 13Article 14Free
CVSS 4.0 Calculator
Score a vulnerability with CVSS v4.0. Base, Threat and Environmental metrics are all supported, and the MacroVector equivalence class the score derives from is displayed alongside the vector so the result can be verified against the specification. A vector can be supplied in the URL to share or re-check a score.
Article 13Article 14Free
CVSS Calculator
Calculate CVSS 3.1 base scores for vulnerability severity assessment. Includes guidance on whether the score triggers Article 14 notification obligations under the EU Cyber Resilience Act.
Article 14Free
Disclosure Deadline Tracker
Enter a vulnerability report date and instantly see every critical deadline: Article 14 early warning, full notification, final report to ENISA, researcher 90-day embargo, and your internal acknowledgment SLA. Colour-coded status keeps you on track.
Article 14Free
Article 14 Notification Template Builder
Build a complete Article 14 early-warning notification based on the fields required by CRA Article 14(2). Fill in your product details, exploitation status, and mitigation actions, then copy the finished notification text ready for submission to ENISA or your national CSIRT.
Annex IArticle 13Free
SBOM Component CVE Checker
Paste a list of software components (package@version, one per line) and instantly generate NVD CVE Database search links for each one. Quickly identify which components need vulnerability triage. Supports npm, pip, Maven, Go modules, and free-form package names.
Annex I Part II(1)Article 13Free
SBOM Validator (BSI TR-03183-2 and CISA 2026 Minimum Elements)
Upload or paste a CycloneDX or SPDX JSON SBOM and check it against BSI TR-03183-2 v2.1.0, the German federal guideline that concretises the CRA SBOM requirement. The validator verifies the minimum specification version (CycloneDX 1.6 or SPDX 3.0.1) and every required data field for the SBOM itself and for each component, including creator, timestamp, dependencies, licences and hashes. Validation runs entirely in your browser. The same document is also assessed against the 2026 Minimum Elements for a Software Bill of Materials, version 2.1, published by CISA with seventeen partner agencies including seven EU national cybersecurity authorities. That document replaced the 2021 NTIA minimum elements and expanded the field count from seven to seventeen. It is not EU law and creates no CRA obligation, but it is increasingly what procurement asks for. The two verdicts are reported separately and never blended, because the frameworks genuinely disagree: TR-03183-2 sets minimum format versions that the 2026 elements do not, and the 2026 elements require transitive dependency coverage that CRA Annex I Part II(1) does not.
Article 13Free
security.txt Generator
Generate a standards-compliant security.txt file (RFC 9116) for your product or website. Required by the EU Cyber Resilience Act to make your vulnerability reporting contact discoverable.
Need more than individual tools?
CVD Portal integrates all these tools into a complete vulnerability disclosure programme — public submission portal, 48-hour acknowledgment tracking, audit trail, and CSAF advisory generation. Receiving and tracking reports is free. Article 14 filing is on Reporting (the September 2026 requirement).
Set up your free portal