Situation
A large organisation with a complex portfolio of products with digital elements was preparing for the introduction of the EU Cyber Resilience Act. While the organisation had strong technical capability, it lacked clarity on how the new regulation applied across its product portfolio, legal entities, and operating model. Different parts of the organisation held different regulatory responsibilities, creating additional complexity around ownership, accountability and compliance.
Leadership needed certainty. With enforcement deadlines approaching, the organisation required clear direction on what needed to change, who was responsible, and how to prepare in a structured and timely way.
At a glance
Customer: Large global organisation with a complex portfolio of products with digital elements
Challenge: Complex product landscape, varied internal interpretations of CRA obligations, third-party component risk and uncertainty around implementation priorities
Solution: NCC Group delivered a phased end‑to‑end CRA readiness programme
Results: Clear regulatory ownership, aligned compliance roadmap, stronger documentation and vulnerability management processes, defined economic operator responsibilities and improved visibility of CRA readiness
Challenge
The organisation’s product ecosystem was large and diverse, making it difficult to determine which products were in scope and which CRA obligations applied. Internal stakeholders also held differing interpretations of key CRA terms such as placing on the market, manufacturer, importer, and substantial modification.
Third party suppliers introduced additional risk due to inconsistent documentation and CRA compliance of their own products which would require additional due diligence checks to be carried out. This also created potential blind spots in vulnerability management and SBOM requirements. The first CRA reporting obligations start in September 2026, with full compliance required by December 2027, so the organisation needed clarity, prioritisation, and a phased implementation plan.
Solution
Following consultation with the client, NCC Group delivered a phased CRA implementation plan designed to provide guidance, alignment, and actionable outcomes.
1. Discovery Phase
The Discovery Phase produced a clear understanding of existing strengths and the areas requiring uplift.
NCC Group began by mapping economic operator roles of the organisation against CRA obligations, including manufacturer, importer, and distributor responsibilities. This phase included a full CRA scope assessment and gap analysis across the CRA Annexes. This mapped obligations against existing organisational processes and procedures including existing vulnerability handling processes and documentation.
This work established a clear baseline of current capability and identified areas requiring uplift.
2. Roadmap Phase
Using the discovery findings, NCC Group developed a unified compliance roadmap addressing the CRA. This included identification of overlapping regulatory requirements, a harmonised documentation model, and the design of a Conformity Gateway to support CRA obligations and assess evidence provided by distributed engineering teams. Third party component due diligence expectations and supplier requirements were also defined.
The roadmap reduced duplication and provided a clear, phased path toward compliance.
3. Implementation Phase
NCC Group then supported hands-on implementation across governance, process, and technical controls. This included design of CRA aligned practices, vulnerability handling and reporting processes, SBOM guidance, and technical documentation updates.
A unified Compliance Dashboard was developed to give real-time visibility of CRA compliance status, supported by training and awareness materials to ensure internal teams understood their ongoing obligations.
Benefits
By engaging NCC Group, the organisation moved from uncertainty to confidence in its CRA journey. The programme delivered regulatory clarification across the product suite and operating entities. A roadmap for CRA compliance gave them targets for a phased implementation approach and a unified compliance dashboard enabled leadership to track progress, manage risk, and prepare for CRA enforcement with clarity and control.
Through this engagement, the organisation gained:
- Clear regulatory understanding across all product lines
- Clarification of their responsibilities for each economic operator role
- Stronger documentation, SBOM, and vulnerability management processes
- Improved supply‑chain governance and third‑party oversight
- Real‑time compliance monitoring through a central dashboard
Key Takeaways
- Early preparation reduces the risk of penalties
- Clear roles and responsibilities are essential for CRA compliance
- Third-party components require strong due diligence
- A harmonised, cross regulation approach creates efficiency
- CRA readiness requires ongoing governance, technical processes, and monitoring