What are the main requirements of NIS2?

NIS2 requires essential and important entities to implement risk management measures, incident reporting protocols, and supply chain security to enhance overall cybersecurity resilience.

How does a NIS2 gap analysis help?

A gap analysis identifies your current security posture versus the NIS2 requirements, providing a prioritized roadmap to achieve compliance efficiently.

What industries are affected by the NIS2 Directive?

The NIS2 Directive affects sectors of high criticality, including energy, transport, banking, health, and digital infrastructure, as well as 'important' sectors like postal services, waste management, and food production.

Cyber Resilience Act Compliance Services

Cyber Resilience Act (CRA) compliance services that help organisations understand regulatory requirements, assess readiness, and prepare products with digital elements for compliance with Regulation (EU) 2024/2847.

Contact sales Learn more

Gabrielius Vinciūnas

Head of Information Security

[email protected]

Vitalis Kavaliauskas

Chief Technology Officer

[email protected]

CRA Compliance Offers

CRA gap analysis

Identify CRA compliance gaps and understand what actions are required before placing products with digital elements on the EU market.

Initial infrastructure review.

Product classification (Class I & II risks).

CRA product risk assessment.

Review of cyber security design practices.

Regulatory gap analysis.

Deliverables:

CRA compliance roadmap with prioritised remediation actions and compliance recommendations.

Request this service

Technical documentation & SBOM strategy

Support with preparing the documentation and evidence required to demonstrate CRA compliance.

Mandatory risk assessments.

Technical documentation preparation.

SBOM strategy development.

Automated SBOM generation processes.

Testing evidence collection.

Deliverables:

Audit-ready technical documentation package.

Request this service

Pre-audit preparation

Preparation for CRA conformity assessment.

CRA conformity assessment.

Notified body preparation.

EU declaration of conformity CRA.

Deliverables:

EU Declaration of Conformity template.

Request this service

CISO as a Service for CRA compliance

Ongoing cyber security leadership and advisory support for organisations preparing for and maintaining CRA compliance.

Virtual CISO support.

Security governance.

Ongoing security testing alignment

Vulnerability management processes.

Supply chain vendor assessments.

Deliverables:

Continuous CRA compliance oversight and cyber security guidance.

Request this service

Our CRA Compliance Process

Gap analysis

We assess your products, processes, and security practices against CRA requirements and identify compliance gaps.

Compliance roadmap

Assessment findings are translated into a practical roadmap outlining remediation priorities, documentation requirements, and conformity assessment activities.

Secure development & SBOM implementation

We help establish secure software development lifecycle practices and implement Software Bill of Materials (SBOM) processes.

04

Conformity assessment & validation

We review documentation, security controls, and testing evidence to prepare products for CRA conformity assessment.

05

Ongoing advisory

We provide ongoing support for vulnerability management, security governance, supply chain security, and evolving CRA requirements.

Who We Help

Manufacturers of products with digital elements

Software products

IoT devices

Embedded browsers

Authorised EU representatives

Non-EU manufacturers

Regulatory representation

EU market access

ENISA regulations

Importers

Importers of Connected Tech

Product verification

Compliance obligations

Distributors

Product distribution

Market surveillance

Compliance verification

Why Baltic Amadeus

Cyber security & compliance expertise.

Experience with EU regulatory frameworks.

Practical implementation support.

Certifications

ISO 9001

Certification mark for TÜV Thüringen with a red checkmark and a red mask symbol.

ISO 27001

CISSP

CISM

View all certificates

FAQ

How does Baltic Amadeus help customers with the CRA?

We help organisations assess readiness, prepare technical documentation, implement SBOM strategies, prepare for conformity assessments, and establish ongoing compliance processes.

Do non-EU companies need CRA compliance?

Yes. Any organisation placing products with digital elements on the EU market must comply with CRA requirements, regardless of where the company is based.

When does the Cyber Resilience Act (CRA) take effect, and what is the timeline?

The CRA entered into force in 2024. Vulnerability reporting obligations apply earlier, while most compliance requirements become mandatory from December 2027. Organisations should start preparing well before enforcement deadlines.