EU CRA ComplianceA Malkan Solutions company
CRA Briefings See the CRA Workbench →Workbench →

Free self-check25 questionsBased on ENISA's SME maturity model

How CRA-ready is your team?

Score your organisation against ENISA's cyber resilience maturity model in one sitting — then see the evidence an assessor would ask you to show for each score.

00
Before you start

A self-check, not a conformity assessment

Rate each of the 25 statements below from 1 to 5 for your organisation as it works today. Your score, band and weakest domain calculate as you go.

  • 1Initial
  • 2Basic
  • 3Developing
  • 4Managed
  • 5Optimised
Read this before you trust the number

Self-attested ≠ conformity. ENISA is explicit that reaching a maturity level does not replace conformity with the Cyber Resilience Act. A market surveillance authority or notified body looks at evidence, not at a self-score.

Only as good as the answers. The result depends entirely on the honesty and awareness of whoever fills it in. That is why each domain in your results lists what an assessor would ask you to show before they accepted the score.

Your answers stay in this browser. Nothing is sent anywhere unless you choose to email your results.

Source: Based on ENISA's SME Cyber Resilience Maturity Assessment Model (July 2026). The questions, 1–5 scale, per-domain level descriptions and BASIC (1–2.5) / INTERMEDIATE (2.6–3.9) / ADVANCED (4–5) bands are reproduced verbatim from ENISA's tool. This is an independent implementation — not affiliated with or endorsed by ENISA. The "what an assessor would ask you to show" layer is ours.

0 / 25 answered
Results ↓
06
Your result

Your CRA readiness score

Answer at least one question to see a score. Unanswered questions are left out of the average.

Method: overall score = the mean of the questions you answered (1–5), shown to one decimal place; each domain score is the mean of its answered questions. Bands follow ENISA's model. Based on ENISA's SME Cyber Resilience Maturity Assessment Model (July 2026) — an independent implementation, not affiliated with or endorsed by ENISA.

A self-score is the starting line.

The CRA Workbench is where you build the evidence behind it — for OT products, with the IEC 62443 bridge built in and an auditor's judgement on every gap.

See the CRA Workbench →

This self-check is general information about Regulation (EU) 2024/2847, not legal advice. It reproduces the questions, scale and bands of ENISA's SME Cyber Resilience Maturity Assessment Model as an independent implementation; it is not affiliated with or endorsed by ENISA. A maturity score is self-attested and does not replace CRA conformity or a conformity assessment. The CRA Workbench is software that produces draft documentation for expert review; it indicates the evidence needed and does not, by itself, guarantee compliance.