A risk assessment built from your attack surfaces.
Article 13 asks for a cybersecurity risk assessment that drives the whole technical file. Regulus starts from how the product connects, proposes the threats for each surface and links each one to the Annex I requirement it affects.
Three steps, no calls.
- 01
Map the surfaces
Interfaces, ports, update channel, cloud API, companion app: everything an attacker can reach.
- 02
Review the threats
Regulus proposes threats per surface. You keep, change or discard them and record the mitigation.
- 03
Generate the document
The risk assessment comes out in Word, with your decisions and nothing you did not record.
Risk assessment in Regulus.
Threats per surface
A threat model organised by attack surface, using the STRIDE categories.
Linked to Annex I
Each threat points to the essential requirement it affects.
Your decisions, recorded
Likelihood, impact and mitigation are yours; Regulus only proposes.
Word document
The cybersecurity risk assessment, ready to file in the technical documentation.
Read more about it.
Our guides on the Cyber Resilience Act, written against the adopted text.
Questions about risk assessment.
Does the CRA require a risk assessment?
Yes. Article 13 requires manufacturers to carry out a cybersecurity risk assessment and to take it into account in design, development and production. It is part of the technical documentation.
Which method should the risk assessment follow?
The CRA does not prescribe one. It must be documented, cover the intended purpose and reasonably foreseeable use, and show how the essential requirements are applied in the light of the risks.
Does Regulus invent risks for my product?
No. It proposes threats from the attack surfaces you describe, and only what you keep and complete goes into the document.
One file, start to finish.
Scope. Check whether the Cyber Resilience Act applies to your product.
Classification. Classify your product under the Cyber Resilience Act by its core function.
Annex I requirements. Track every Cyber Resilience Act essential requirement of Annex I.
Technical file. Generate the Cyber Resilience Act technical file in editable Word.
Article 14 reporting. Meet the Cyber Resilience Act reporting obligations of Article 14.
Start with your own product.
Free for manufacturers. An expert is one click away when you want one.