Our journey to CRA
summary
Company establishes a programed effort to meet the CRA, keeps ISO 27001 certification, and converts vulnerability intake by becoming a CVE number authority in early 2025. Roadmap and gaps are tracked as public Jira tickets with a consultant-led assessment producing concrete requirements. Product work splits into five product workstreams, support periods extend from three to five years, and a mid-2026 self-declaration certification target drives threat analyses, customer workshops, an early-warning list, and tooling and training rollouts.
AI-written summary · about
chapters (7)
- 0:00Qt Company journey
- 3:33Customer queries on CRA
- 7:04CRA compliance program launch
- 10:11Key milestones and assessments
- 14:262025 targets and certification
- 17:58Change management challenges
- 20:05Q&A
related talks
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
54mThe CRA, Where Are We Six Months After Its Approval
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
36mThe CRA roadmap: What to expect
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
01h 18mEU CRA TL/DR for PSIRTS - What Product Security Needs To Do To Be Compliant with the CRA
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
56mCISA’s North Star Vision for the CVE Program