CYBER RESILIENCE ACT · PRACTICAL TEMPLATES FOR MANUFACTURERS
Cyber Resilience Act Templates for Manufacturers: the CRA Practice Kit
From legal requirements to an editable workflow: 37 templates, detailed guidance, a complete worked product example and quality checks for manufacturers of products with digital elements.
B2B digital product · local editing · company licence · one selected product language · EUR 490 net one-time payment
The CRA Practice Kit is a structured working and documentation aid. It is not legal advice, certification, a formal conformity assessment or confirmation that a product complies with the CRA.
Module AProduct & responsibilities
Module CRisks & residual risks
Module DComponents & SBOM
ABCDEFG
Overview
Why manufacturers need a structured basis now
The reporting obligations under the Cyber Resilience Act for actively exploited vulnerabilities and severe security incidents apply from 11 September 2026. The main remaining obligations apply from 11 December 2027.
The Practice Kit provides a coherent, locally editable template and working structure for these tasks.
- product and responsibility boundaries
- requirements and gap assessment
- cybersecurity risk assessment
- component and supplier management
- SBOM preparation, vulnerability management, updates and reporting routes
Delivery scope
What the CRA Practice Kit includes
Working documents
- 37 editable Word and Excel templates
- seven completion guides
- seven start and sequencing guides
Examples and checks
- 37 fully completed example documents
- one machine-readable CycloneDX example
- seven module-specific quality checks
Licence and language
Company licence for one named legal entity and the currently released product language Deutsch.
Modules
Seven modules for a connected CRA workflow
Module A - Product and responsibilities
Define the relevant product, variants, digital functions and responsibilities.
- product scope worksheet
- product variant and version overview
- roles and responsibilities matrix
- stakeholder and supplier overview
- structured CRA applicability assessment
Module B - Requirements and gap assessment
Transfer relevant requirements into an editable working structure.
- CRA requirements matrix
- gap assessment
- action and priority plan
- responsibility and schedule plan
Module C - Cybersecurity risk assessment
Capture assets, protection needs, threats, risks, treatments and residual risks consistently.
- asset and protection needs assessment
- threat and misuse scenarios
- cybersecurity risk assessment
- risk treatment plan
- residual risk register
- residual risk approval record
Module D - Components, SBOM and supply chain
Create transparency regarding software, hardware, open-source and third-party components.
- component inventory
- SBOM preparation and validation
- supplier questionnaire
- open-source and third-party component register
- machine-readable CycloneDX example
Module E - Vulnerabilities, updates and support
Prepare the organisational handling of vulnerabilities, security updates and support periods.
- vulnerability management process
- vulnerability register and triage
- coordinated vulnerability disclosure policy
- security update and patch process
- support period and end-of-support decision
- security advisory template
Module F - Incidents, reporting and communication
Define responsibilities, assessment steps, escalation routes and communication paths for incidents.
- incident escalation matrix
- internal incident assessment
- CRA reporting process
- communication and decision log
Module G - Technical documentation and conformity preparation
Connect requirements, risks, tests, evidence, changes and internal approvals.
- CRA documentation map
- evidence and test matrix
- technical documentation structure
- change assessment
- internal product release
- conformity assessment preparation
Product value
More than empty forms
The kit connects templates, guidance, example documents and quality checks into one consistent working model. The complete example shows how decisions and evidence can be maintained consistently across several documents.
Price and company licence
CRA Practice Kit for Product Manufacturers
Your investment: EUR 490 net one-time paymentCompany licence for one named legal entity and the currently released product language Deutsch.
Within this licensee, internal use by any number of employees and contracted persons is permitted, as well as use for any number of the licensee's own products, product variants and internal projects.
Process
How to order and receive the CRA Practice Kit
1. Enter details
Enter company, billing and licence information and select the product language.
2. Review the order
Check product, language, price, licensee, billing details and binding declarations.
3. Send the email
The website prepares an order email. The contract is concluded only by order confirmation or clear delivery.
Data protection
Your product data remains with you
The templates are edited locally in your own business environment. Product information, risk assessments, component lists and technical evidence are not automatically transmitted to SP Services when you use the kit.
The order form also works without automatic server transmission. The entered information is processed only within the open browser page and is transmitted only when you send the prepared email.
FAQ
Frequently asked questions
Is the CRA Practice Kit a certification?
No. It is a digital working and documentation package. It does not certify CRA conformity and does not replace a product-specific assessment.
Does completing all templates guarantee CRA compliance?
No. The templates support structured preparation and documentation. Compliance depends on the product, implemented measures, tests and the manufacturer's responsible assessment.
Is the kit only intended for software manufacturers?
No. It is also designed for manufacturers of machinery, devices, controllers, test equipment, industrial components and other technical products with digital functions.
Are the files editable?
Yes. The working templates are supplied in editable Microsoft Word and Microsoft Excel formats. The CycloneDX example is supplied as machine-readable JSON.
Does the kit include an SBOM for our product?
No. It includes templates for component inventory, SBOM preparation and validation, and a machine-readable example. It does not generate a production SBOM for your product.
May several employees use the kit?
Yes. The company licence permits internal use by any number of employees and contracted persons working for the named licensee.
May affiliated companies use the kit?
Not automatically. The licence applies to the legal entity or legally capable partnership named in the order.
How do I place an order?
Complete the order form, review the information and then send the prepared binding order email using your own email application.
Order
Place a binding order for the CRA Practice Kit
The website prepares a binding order email. The order is transmitted to SP Services only when you send that email using your own email application.
Your investment: EUR 490 net one-time paymentCompany licence for one named legal entity and the currently released product language Deutsch.For companies in Germany, 19% VAT will be added. For companies in other EU Member States, VAT treatment is determined after checking the submitted VAT ID.
Send your order
Opening the email application does not transmit any information. The order becomes binding only when you send the prepared email yourself.