The Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for products with digital elements placed on the European Union market. From December 2027, manufacturers, importers and distributors, including micro, small and medium-sized enterprises (SMEs), will be required to ensure that their products remain secure throughout their entire life cycle.

SMEs represent a significant part of Europe’s digital ecosystem, and their ability to understand and implement the CRA will be essential to the Regulation’s successful application. However, smaller organisations often face practical challenges, including limited resources, specialised expertise, time and implementation capacity.

To address these challenges, the European Union Agency for Cybersecurity (ENISA) is developing practical guidance, tools and support activities tailored to the needs and operational realities of smaller organisations.

The SME Cyber Resilience Maturity Assessment Model provides micro, small and medium-sized enterprises with a structured method for assessing and strengthening their cyber resilience, while also taking into account the requirements of the CRA.

The model is primarily intended for organisations that manufacture and place products with digital elements on the market, as they are directly subject to the CRA. However, it may also be used by other organisations involved in the product life cycle to assess and improve their product security practices. Recognising that many SMEs may not have dedicated cybersecurity teams or specialised expertise, the model has been designed to be practical, accessible and easy to apply. It helps organisations understand their current level of cyber resilience, identify priority areas for improvement and gradually develop stronger and more sustainable cybersecurity practices.

For additional information and the tool click here.