The Cyber Resilience Act checklist
Download your practical, step-by-step guide to meeting the CRA’s requirements
The EU Cyber Resilience Act (CRA) sets new security rules for connected products sold in the EU. For device makers, that means fresh obligations across the whole product lifecycle: classifying your device, reporting vulnerabilities, proving conformity, and more. The rules run to hundreds of pages, the deadlines are fixed, and the work reaches almost every team you have.
The hard part is usually knowing where to start.
We built this checklist to help with exactly that. It turns the CRA into a clear set of actions your team can work through, section by section. You begin with scope and classification, since that decides your conformity route. From there, your team can tackle the remaining sections in parallel and tick off each obligation as you go.
The checklist also shows where Canonical and Golioth give you a paved path to compliance, so you can see which requirements are already covered by products like Ubuntu Core, Ubuntu Pro for Devices, and Landscape.
Download the checklist to work through:
- How to classify your product under the CRA, and why that one decision shapes everything that follows
- The deadlines that matter most in 2026 and 2027, and which obligations to meet first
- What vulnerability reporting asks of you, including the 24 and 72 hour CSIRT reporting windows
- How to prepare OTA updates, SBOMs, and technical documentation that stand up to an audit
- The secure-by-design requirements your product must meet before it reaches the market
- Where Canonical and Golioth cover core CRA requirements, so you know what you no longer have to build yourself
The CRA is a lot to take on, but you do not have to face it unprepared. This checklist gives device makers a practical starting point and an honest view of what readiness really involves.
Download the free CRA checklist and see exactly where your product stands today, or talk to our CRA experts.