Regulation (EU) 2024/2847 — Cyber Resilience Act, entered into force 10 December 2024. Establishes mandatory cybersecurity requirements for products with digital elements (hardware and software) sold in the EU.
Regulation (EU) 2024/2847 — Cyber Resilience Act, entered into force 10 December 2024. Establishes mandatory cybersecurity requirements for products with digital elements (hardware and software) sold in the EU.
Manufacturers must ensure security by design, provide security updates for product lifetime (minimum 5 years), report actively exploited vulnerabilities to ENISA within 24 hours, and maintain technical documentation. Applies to manufacturers, importers, and distributors.
Fines up to 15M EUR or 2.5% of global turnover.
Official source: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
ThreeShield's CISSP- and CISA-certified assessors run the EU Cyber Resilience Act (CRA) engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.
Fines up to 15M EUR or 2.5% of global turnover.
| EU Cyber Resilience Act (CRA) requirement | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Multi-factor authentication status | ✓ Continuously | — |
| Patch and vulnerability posture | ✓ Continuously | — |
| Encryption at rest and in transit | ✓ Continuously | — |
| Access and audit-log review | ✓ Continuously | — |
| Risk assessment and scoping | ⚑ Platform data | CISSP/CISA-led |
| Policies, procedures, and evidence package | — | Written by ThreeShield |
If your organization operates in scope for EU or in the security sector, EU Cyber Resilience Act (CRA) likely applies. Regulation (EU) 2024/2847 — Cyber Resilience Act, entered into force 10 December 2024. We confirm scope in the first call, at no charge.
It depends on your starting point. A gap assessment against EU Cyber Resilience Act (CRA) is usually a few weeks; closing the gaps and standing up the evidence takes longer and is where most of the work sits. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.
Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.
ThreeShield meets you at your current security maturity. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full compliance delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.
Book a Scoping CallDIY · Supported · Done-for-You