Coritra

Know exactly where your software stands against the CRA

A fixed-scope audit against the EU Cyber Resilience Act: CVE analysis, SBOM, Annex I gap analysis and a prioritized remediation plan.

You bring the software, we map the road to compliance

A written audit you can act on: CVE analysis, a full SBOM, the Annex I gap analysis and a remediation roadmap with priorities, all inside one fixed scope.

What's inside the perimeter

  • CVE analysis of your dependencies, scored by real risk to your product
  • A full SBOM generated for the software you place on the market
  • Gap analysis against the essential requirements of Annex I, clause by clause
  • A recommended support period for your product, written with its justification
  • Reporting readiness: the 24-hour and 72-hour duties, wired to the ENISA platform
  • A remediation plan ordered by priority, ready to be executed or costed

What you receive

  • A written audit report: your status against each Annex I requirement
  • The SBOM of your product, in a standard format ready to share
  • The prioritized remediation roadmap, with the effort of each step marked
  • A working session with your team to walk through findings and next moves

No monthly retainer here: the remediation itself can be executed as a follow-on fixed-scope service, planned from the roadmap this audit delivers.

What we audit

The CRA covers any product with digital elements placed on the EU market. Most of what we audit takes one of these shapes.

Web apps and SaaS

Software delivered through the browser, hosted by you or by a cloud: users connect, so it is in scope.

Mobile apps

Android and iOS apps, including the backend they depend on.

Desktop software

Installed applications, shipped standalone or bundled with hardware.

Embedded and IoT firmware

Device firmware and the software around it: the CRA's most demanding category.

APIs, SDKs and libraries

Code you ship to other developers: your compliance feeds into theirs.

Not sure you are in scope?

Scope is the CRA's hardest question. Describe your product to us and we will answer it plainly.

When this service fits

If you already know every gap and only want them closed, an audit buys you nothing. This service is for the moment before that.

  • Any company size counts: the CRA looks at the product you ship, not at the headcount behind it.

  • Incident reporting has applied since September 2026, full compliance is due December 2027. Waiting is itself a risk now.

  • A report, an SBOM and a roadmap you can hand to a customer, an auditor or your own board.

This audit states where you stand, it does not change a line of code. If you already hold a current report and SBOM, the hardening service is the right door to close the gaps.

How it unfolds

  1. 1

    Access review

    We review the software, repositories and dependencies you put in scope, under strict confidentiality, before any analysis starts.

  2. 2

    Security analysis

    CVE analysis, SBOM generation and the Annex I gap assessment run against your actual product, not a template.

  3. 3

    Report and plan

    The full report and prioritized remediation plan land in your inbox, then we walk your team through both together.

  4. 4

    Remediation follow-on

    If you choose, the remediation itself runs as a separate fixed-scope service, priced from the roadmap this audit produced.

Services

Tell us the problem

Describe what hurts, in plain words. No technical brief required.

Start a conversation

We reply within 24 hours with a first scope and a fixed-price estimate.