Question 1

Does CRA actually apply to my SaaS product?

Accepted Answer

SaaS sits primarily under NIS2, not CRA — but CRA captures any "product with digital elements" you ship to the EU, including downloadable software, embedded firmware, and IoT. Most companies have at least one product in scope. We’ll establish that on day one of the engagement.

Question 2

We already use Snyk / Black Duck / GitHub Advanced Security. Why do I need this?

Accepted Answer

Those tools generate data. They don't tell you whether your engineering org can pass a regulatory audit, survive due diligence, or execute the remediation. That's the gap this audit fills. We'll work alongside whatever tooling you already have.

Question 3

What does "From €9,500" mean? When does it go up?

Accepted Answer

€9,500 covers a single product / single repo / team up to 15 engineers and 500K LOC. Multi-product orgs, monorepos over 1M LOC, or teams above 30 engineers move to €14,500 or €19,500 depending on scope. Quoted before signature, never after.

Question 4

How is this different from a traditional code audit or pen test?

Accepted Answer

A pen test finds vulnerabilities in production. A code audit assesses code quality. This audit is broader: it answers whether your engineering organisation — codebase, processes, people, and documentation — can pass CRA scrutiny and survive technical due diligence. It's an organisational assessment, not just a technical one.

Question 5

What do you need from us to start?

Accepted Answer

Read access to your primary code repositories, two hours of CTO/engineering lead time across the engagement, and one stakeholder interview each with security, product, and operations leads. We sign a mutual NDA before any access is granted.

Question 6

What happens after the readout?

Accepted Answer

You own the deliverables outright. About half of audits convert into a follow-up fractional CTO retainer to execute the remediation; the other half are handed back to internal teams. There's no obligation either way — the audit stands alone.

EU Cyber Resilience Act (CRA) Readiness Audit