📋 Tender Overview
The European Cyber Security Agency (ENISA) has published the SME Cyber Resilience Maturity Assessment Model, a practical tool for self-assessment of cyber resilience. It is intended primarily for micro, small and medium-sized companies that develop, manufacture, import or distribute products with digital elements and are preparing to implement the requirements of the Cyber Resilience Act.The Cyber Resilience Act (CRA) introduces uniform cybersecurity requirements for products with digital elements placed on the European Union market. The provisions of the Cyber Resilience Act will come into force in December 2027, so timely preparation is important for all organizations affected by the regulation.
ENISA has therefore prepared a practical Excel self-assessment tool that helps organizations assess the current level of maturity in the field of cyber security of products, identify areas for improvement and plan further activities.
The tool is mainly intended for:
micro, small and medium-sized companies that, as manufacturers, importers or distributors, place products with digital elements on the market and will be liable under the CRA,
organizations involved in the life cycle of such products, such as system integrators or service providers,
but it can also be used by other organizations that want to systematically improve the security of their digital products.
The self-assessment is based on 25 questions divided into five key areas:
management and documentation,
risk management and security by design and security by default,
vulnerability and security patch management,
product life cycle management,
awareness, competences and knowledge.
After completing the questionnaire, the tool automatically prepares the results and classifies the organization into a basic, intermediate or advanced level of maturity. In addition to the overall assessment, it also shows results in individual areas and prepares a list of recommendations and priority measures for further improvements.
Such an approach enables companies to:
identify gaps in the security of their products,
prioritize improvements based on risks,
plan to develop security practices,
monitor progress in strengthening cyber resilience,
are systematically preparing to implement CRA requirements.
It is important to note that the tool does not constitute proof of compliance with the Cyber Resilience Act. It is intended to support self-assessment and incremental improvement of product cybersecurity and is not a substitute for legal judgment, formal compliance assessment or risk assessment.
Connections
More information about the model and download the documentation: ENISA - SME Cyber Resilience Maturity Assessment Model (in English)
Direct access to the Excel self-assessment tool (in English)
