CISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget

Should the CISO lead the CRA, or the product business unit?

The CRA places obligations on the manufacturer as a legal entity (Article 13); it names no department.

(R = responsible, A = accountable, C = consulted, I = informed)

Product security or compliance is the second line, providing expertise and oversight, and the CISO usually sits there; the IT department runs the company's internal systems, so product security should not default to it. Each task has only one A, and final accountability and independent assurance should not sit with the same person.

How do we connect the CRA Article 14 24-hour early warning to our existing incident response procedure?

Actively exploited vulnerabilities and severe incidents are reported through the ENISA single reporting platform to the CSIRT designated as coordinator and to ENISA at the same time: early warning within 24 hours, notification within 72 hours; the final report is due within 14 days after a corrective measure is available for vulnerabilities, and within one month of the notification for incidents.

• Add a path, not a new system: the procedure under Article 34 of the Cybersecurity Control Guidelines covers incidents in the company's own information systems; the CRA covers vulnerabilities in products, so write separate triggers and external contacts.
• Give the contact authority: if the contact cannot decide whether to report, the 24 hours will be missed.
• List deadlines side by side: one incident can also trigger GDPR or NIS2; decide in one incident classification step.

Companies that are not public companies are not covered by the guidelines and can use them voluntarily.

We already hold ISO 27001 or IEC 62443 certificates. Does that mean we pass the CRA?

No. The CRA asks whether this product meets Annex I; 27001 looks at the organisation's management system. No ISO/IEC certificate equals CRA conformity, and IEC 62443 certification is not a presumption of conformity either: presumption comes only from harmonised standards published in the Official Journal, common specifications or designated certification schemes (Article 27).

Conformity assessment routes:

• Default products: the manufacturer self-assesses under module A of Annex VIII.
• Important products, class I: self-assessment only when applying harmonised standards, common specifications or a European cybersecurity certification scheme; otherwise a notified body is needed.
• Important products, class II, and critical products: a notified body or a European cybersecurity certification scheme must be involved.

As of August 2026 no CRA harmonised standard had been published, so prepare against the published draft standards now.

How far must SBOM and vulnerability handling go? How do we manage open-source and supplier components?

Annex I Part II requires: an SBOM in a commonly used, machine-readable format covering at least top-level dependencies (point 1); handling and remediating vulnerabilities without delay (point 2); putting in place and enforcing a CVD policy (point 5); a contact address for reports (point 6); distributing security updates without delay once available (point 8). In the JRC and ENISA mapping, ISO/IEC 30111 covers five of the eight requirements; SBOM, regular testing and secure distribution of updates must be covered by other means.

• Components: exercise due diligence when integrating third-party components, including open source (Article 13(5)), and notify the maker or maintainer when you find a vulnerability in a component (Article 13(6)).
• Support period: at least five years (or the expected use time if shorter), handling vulnerabilities throughout.
• Scan results: a scanner hit is not a confirmed vulnerability; you must be able to trace it to product version and treatment.

How should the CRA timeline be planned, and which steps cannot be compressed?

Five dependent phases: classification and role, cybersecurity risk assessment, essential requirements and technical documentation, conformity assessment, operations during the support period.

Cannot be compressed: if step 1 is wrong, everything after it is redone; if step 4 needs a third party, timing depends on the notified body's schedule. The reporting process must work now and should run in parallel with conformity assessment, not after it.

With a limited budget, which part should the CISO commission first, and what drives the quote?

The service page splits CRA work into three packages that can be commissioned separately and quoted item by item:

The quote depends on: number of product series and versions, available SBOM and remediation evidence, how much existing testing and procedures can be reused, document language and assessment route, and customer requirements, internal staffing and deadlines. Actual remediation, test laboratories and third-party assessment fees are excluded.

How does Winners Consulting help a CISO with the EU CRA?

• Decide first: whether the product is in scope, which class it falls into and which conformity assessment route applies.
• Build the processes: the vulnerability handling process, SBOM and Annex VII technical documentation required by Annex I, and the Article 14 reporting process.
• Assign to real units: help each product line put the responsibility matrix and reporting process into actual units and authorities.
• Division of roles: Winners Consulting is a consultant and does not assess (Article 39(4) of the CRA bars assessment bodies from consultancy); VP- and director-level consultants lead the work end to end, never outsourced.
• Track record: as of 2026-10, Winners has 6 EU Cyber Resilience Act (CRA) compliance engagements (names withheld under NDA).

Read more: EU CRA consulting, who leads the CRA, CRA timeline, CRA budget, choosing a CRA consultant. Apply for a free mechanism diagnosis