ONEKEY Presents “CRA Fast Start” at it-sa 2026

‍The Düsseldorf-based firmware security specialist will focus on compliance with the Cyber Resilience Act (CRA) at it-sa in Hall 9 (Booth 9-346)

Düsseldorf/Nuremberg, September 29, 2026 — Since September 11, manufacturers of connected devices, machines, and systems have been required to actively report vulnerabilities and serious security incidents in accordance with the Cyber Resilience Act (CRA). At the same time, pressure is mounting to comply with all CRA obligations, which will take effect on December 11 of next year. From that date on, products with digital elements may only be placed on the European Union market if they meet the essential cybersecurity requirements of the EU Regulation. This means that vulnerabilities must be addressed throughout the support period, software components must be documented, and a conformity assessment must be available.

To meet the growing demand for CRA compliance, the Düsseldorf-based cybersecurity company ONEKEY will present its “CRA Fast Start” program at it-sa 2026 (October 27–29) at booth 9-346. The program allows manufacturers to assess their products against CRA requirements in a structured manner and get started without lengthy lead times. It is estimated that the Cyber Resilience Act affects hundreds of millions, if not billions, of digital products in the EU.

The “CRA Fast Start” program is based on the following pillars: CRA Readiness Assessment; creation of software bills of materials (SBOMs) to establish a solid foundation for ongoing CRA compliance; systematic vulnerability management; and continuous monitoring. The program is suitable for companies at various stages of readiness. For manufacturers in the early stages of addressing CRA requirements, the assessment serves as a guide. Those who already understand the extent to which they are affected by the CRA and require rapid implementation can begin directly with vulnerability management and continuous monitoring. Additionally, a compliance check and a wizard assist with the initial CRA compliance review. The wizard is continuously updated to reflect future regulatory requirements and anticipated harmonized standards.

"With CRA Fast Start, we provide manufacturers with a systematic and rapidly deployable approach to meeting the CRA’s legal requirements," explained Jan Wendenburg, ONEKEY's CEO.

Get Started with the CRA Readiness Assessment

An initial, structured CRA Readiness Assessment is a core component of the program. This assessment analyzes a company’s level of readiness for the CRA requirements. In addition to product requirements, the assessment examines existing processes for addressing vulnerabilities, SBOM documentation and organizational responsibilities, among other things. Based on the results, compliance gaps can be identified and priority actions defined. ONEKEY particularly recommends this assessment to companies that are unsure how the CRA applies to them and which steps they need to take.

Continuous Monitoring for Potential Vulnerabilities

The next step applies to all companies, including those that have already started preparing for CRA compliance. Ongoing vulnerability management and continuous monitoring help identify existing gaps. SBOMs ensure transparency throughout the software supply chain. New vulnerabilities, affected libraries, and security-related changes are continuously tracked, ensuring ongoing transparency regarding the security status of digital products. The ONEKEY Product Cybersecurity & Compliance Platform is used for this purpose.

Launching a Long-Term Security Strategy

"Our platform, combined with the CRA Readiness Assessment, unites our expertise in consulting with the extensive analytical capabilities of the ONEKEY platform. This enables us to take immediate action while simultaneously paving the way for a long-term strategy to ensure compliance,” Jan Wendenburg said. He also clarified: "Ultimately, for manufacturers, this is about more than meeting mandatory legal requirements. They also need to effectively protect their product portfolios against cyberattacks. Any vulnerability that is successfully exploited can create both legal and reputational risks.”