Frameworks
Bring products with digital elements to the EU market with CRA compliance
Selling software or connected hardware in the EU without a plan for the Cyber Resilience Act puts your CE marking at risk.
Tidal makes CRA compliance manageable. Work through the essential cybersecurity requirements and the vulnerability handling obligations, keep the technical documentation current, and be ready to report actively exploited vulnerabilities.
These companies run their compliance on Tidal Control
The CRA in depth
Annex I Part I of the CRA lists the essential cybersecurity requirements a product with digital elements has to meet: designed according to its risks, released without known exploitable vulnerabilities, secure by default, protected against unauthorised access, with integrity and confidentiality of data, data minimisation, availability of essential functions and the ability to remove data securely.
These requirements are easy to read as a description of good engineering and leave there. A market surveillance authority will ask for the risk assessment and the evidence behind each requirement, and that lives in the technical documentation.
By linking each requirement to the controls, tests and design decisions that meet it, the technical documentation stays current with the product. A new release is a moment to check the evidence, not to rebuild it.
How Tidal helps you get certified
Hit the ground running
Start with our pre-built controls, policies, and risk assessment templates.
Our platform guides you through establishing your ISMS scope, identifying assets, and implementing right-sized controls that match your business needs.
Why Tidal Control
We understand your challenges because we've been there. Our team of GRC experts and security professionals built Tidal to solve the real problems compliance teams face every day.
Made in Europe
Built and hosted in Europe. Your compliance data stays in the EU for full control and peace of mind.
Continuous automation
Automated evidence collection from cloud providers and development tools working 24/7 for you.
Real security
Build secure systems that protect your business and satisfy auditors, not just check compliance boxes.
Go beyond the CRA
Explore frameworks that support secure product development.
IEC 62443
Building industrial components? The IEC 62443 series sets security requirements for industrial products and systems that align closely with the CRA.
NIS2
Also providing services in the EU? NIS2 covers the security of your organisation, where the CRA covers your products.
ISO 27001
Need an organisational foundation? An ISO 27001 ISMS gives structure to the risk management and supplier controls the CRA assumes.
NIST CSF
Want a common language for product security risks? The NIST Cybersecurity Framework structures controls around identify, protect, detect, respond and recover.
Integrate with your existing tools
Testimonials
What our customers say
With a single click, one Tidal test checks dozens of disks for encryption. Doing that manually would take a lot of time.
Frequently asked questions
The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) is an EU regulation that sets cybersecurity requirements for products with digital elements: hardware and software that connect to a device or a network, such as connected devices, desktop and mobile apps, and the components they are built from. It entered into force on 10 December 2024.
The obligation to report actively exploited vulnerabilities and severe incidents applies from 11 September 2026. The other obligations, including the essential cybersecurity requirements, the conformity assessment and the CE marking, apply from 11 December 2027 to products placed on the market from that date.
Manufacturers carry most of the obligations, because they design or have the product designed and place it on the market under their own name. Importers and distributors have their own, lighter obligations, such as checking that a product carries the CE marking and that the manufacturer has met its duties. Software supplied only as a service, without a product, falls outside the CRA, although NIS2 can apply to its provider.
Annex I has two parts. Part I lists the essential cybersecurity requirements for the product itself, such as no known exploitable vulnerabilities at release, a secure default configuration, protection against unauthorised access, data minimisation and the ability to remove data securely. Part II lists the vulnerability handling requirements for the manufacturer, such as a software bill of materials, regular testing, a coordinated vulnerability disclosure policy and security updates for the support period.
The CRA framework in Tidal holds the 71 articles of the regulation, the 14 requirements of Annex I Part I and the 8 vulnerability handling requirements of Annex I Part II, 93 in total. You link each requirement to the controls, tests and documents that meet it, and the platform shows which requirements still have no evidence.
NIS2 is about the security of the organisation and the services it provides, the CRA about the security of the products it places on the market. A manufacturer can fall under both. Secure development, vulnerability management and incident handling count towards both, so Tidal lets you evidence them once.