{"id":3638,"date":"2026-02-16T10:12:22","date_gmt":"2026-02-16T10:12:22","guid":{"rendered":"https:\/\/www.carmasec.com\/?post_type=knowledge-center&p=3638"},"modified":"2026-06-01T11:10:48","modified_gmt":"2026-06-01T11:10:48","slug":"case-study-product-security-and-cyber-resilience-act","status":"publish","type":"knowledge-center","link":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/","title":{"rendered":"Case Study: Product Security and Cyber Resilience Act"},"content":{"rendered":"\n
\n
\n
\n
<\/div>\n
\n
\n

Customer<\/p>\n

A global manufacturer of smart home appliances, headquartered in Germany
\r\n<\/p>\n <\/div>\n

\n

Industry<\/p>\n

Electronics \/ Consumer Electronics
\r\n<\/p>\n <\/div>\n

\n

Challenge<\/p>\n

CRA compliance for a product, taking into account complex corporate structures and customer requirements
\r\n<\/p>\n <\/div>\n

\n

carmasec roll<\/p>\n

Cybersecurity consultancy and implementation partner<\/p>\n <\/div><\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n

A globally operating electronics manufacturer must align its entire development process with the Cyber Resilience Act. No critical products, but complex structures, historically evolved processes, and competency gaps across multiple departments. What follows is not a compliance project. It is a restart of product security. <\/p>\n\n <\/article>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n

Initial Situation: High Uncertainty, Limited Time<\/h2>\n

With the entry into force of the Cyber Resilience Act (CRA)<\/a>, a globally operating manufacturer of smart household appliances based in Germany must ensure the cybersecurity of its products with digital elements\/components throughout their entire product lifecycle. Initially, there was significant uncertainty regarding the exact implications of the CRA for digital products and how this could be reconciled with existing product and software development processes. It was also unclear which products were (not) affected by the CRA and which CRA requirements were already (partially) implemented. <\/p>\n

The manufacturer commissioned our cross-functional expert team to develop a holistic strategy for achieving CRA compliance in order to establish a high level of cybersecurity throughout the entire lifecycle of digital products.<\/p>\n

 <\/p>\n

Challenges<\/strong><\/h2>\n

<\/h3>\n

Historically Evolved Processes<\/h3>\n

The manufacturer’s existing product and software development processes had partially evolved over an extended period and in an inconsistent manner. Furthermore, cybersecurity aspects had not been given significant consideration or were only addressed sporadically. <\/p>\n

Complex Corporate Structure<\/h3>\n

The complexity of our globally operating client’s corporate structure presents another challenge. The company consists of numerous autonomous departments with limited communication interfaces between them. Cybersecurity had previously been considered in only a few departments, and there in very different ways. <\/p>\n

Resources and Competencies<\/h3>\n

The personnel and financial resources as well as the necessary expertise required for implementing the Cyber Resilience Act (CRA) were distributed very unevenly across departments and were completely absent in some areas. Consequently, there was significant uncertainty regarding the measures required to meet CRA requirements. <\/p>\n

Integration with Other Regulations and Internal Requirements<\/h3>\n

Since other national, European, and international regulations also impact the company, overlaps and duplications between them are not known or considered. Furthermore, internal company requirements partially cover these regulations already or hinder their fulfillment. Harmonization of these regulations and requirements had not yet taken place. <\/p>\n

To address these challenges and develop solutions, our CRA Cybersecurity expert team<\/a> was commissioned.<\/p>\n\n <\/article>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n

Approach: Structured, Step by Step<\/h2>\n\n <\/article>\n <\/div>\n <\/div>\n<\/section>\n\n\n
\n
\n
\n
\n \n
\n \"Icon\n

Identify Products & Regulations
\n<\/strong><\/p>\n<\/figcaption>\n <\/figure>\n \n <\/div>\n

\n \n
\n \"Icon\n

Clarify Responsibilities & Budget<\/strong><\/p>\n<\/figcaption>\n <\/figure>\n \n <\/div>\n

\n \n
\n \"Icon\n

Conduct Gap Analysis<\/strong><\/p>\n<\/figcaption>\n <\/figure>\n \n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n
\n \n
\n \"Icon\n

Prioritize Risks<\/strong><\/p>\n<\/figcaption>\n <\/figure>\n \n <\/div>\n

\n \n
\n \"Grafik\n

Implement Measures<\/strong><\/p>\n<\/figcaption>\n <\/figure>\n \n <\/div>\n

\n \n
\n \"Grafik\n

Demonstrate Conformity<\/strong><\/p>\n<\/figcaption>\n <\/figure>\n \n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n

Identify Affected Products and Regulations<\/h4>\n

The first step toward successful CRA implementation consisted of identifying the affected products. This required analyzing the entire portfolio and the complex structure of the company and identifying the products that fall under the CRA. During the review, an analysis was also conducted to determine whether the client or product might also fall under other relevant regulations (NIS-2 or RED – Radio Equipment Directive). <\/p>\n

This classification served as the basis for subsequent steps.<\/p>\n

Clarify Responsibilities and Budget<\/h4>\n

Following the identification of affected products, a clear assignment of responsibilities was developed jointly. Roles for CRA implementation within the company were defined and visibility for the topic was achieved at the management level. At the same time, the required budget for implementing CRA requirements was estimated and calculated to ensure sufficient resources and competencies were available for implementation. Budget planning considered both one-time and ongoing costs. A clearly defined budget enabled realistic and efficient implementation of security measures. <\/p>\n

To conclude the planning phase, the further timeline was defined to meet the important EU deadlines and avoid delays in the release of new products. Since the company addressed the CRA in a timely manner, no major delays occurred. <\/p>\n

Target\/Actual Analysis of CRA Requirements<\/h4>\n

A target-actual analysis was then conducted to compare the company’s and products’ existing security measures with CRA requirements and identify gaps. Through document review, technical interviews with contacts, and examination of audit reports, we arrived at the following findings: <\/p>\n

The company’s products already had basic security mechanisms, but the structures and processes within the company were not aligned with the new CRA requirements. While measures such as software updates and access controls existed, the product lifecycle lacked a systematic security concept based on the Security by Design principle. Security aspects were not considered during the design phase, but only shortly before or even after product release. Furthermore, some products lacked the Security by Default principle, as they were delivered with a default password. Software updates were not made available throughout the complete lifecycle of the devices due to insufficient technical capabilities, and were often discontinued after just 3 years. Additionally, it was determined that the company lacked the processes and infrastructure for the required Incident Response Management and Security Monitoring. Employees were only partially trained in cybersecurity. The company’s documentation (general product description, risk assessments, and applied standards) was partially available, but the required SBOM (Software Bill of Materials) was missing. <\/p>\n

These findings were then compiled in a report to provide the client with a transparent overview of their current status. The result showed which measures were already compliant and which measures would need to be introduced in the further course. Based on the report, concrete recommendations for action were formulated. <\/p>\n

Analyze Risks Within Affected Products<\/h4>\n

Following the target-actual analysis, a detailed risk analysis was conducted. Potential security risks for the products were evaluated. Traditional vulnerability analyses were combined with Threat-Informed Defense (TID) to establish a well-founded prioritization of required security measures. <\/p>\n

Furthermore, penetration tests were conducted on some products with the goal of identifying critical product vulnerabilities. In this way, we completed our picture of the company. Based on the insights gained, we prioritized the required security measures and incorporated them into our recommendations for action. <\/p>\n

 <\/p>\n

Implementation of Identified Measures (Procedural & Technical)<\/h2>\n

The first measure implemented was training relevant personnel. In addition to the knowledge conveyed, this had the side effect of enabling us to better involve employees in the implementation of measures. <\/p>\n

A particular challenge was presented by the historically evolved product and software development processes, which had emerged over years without a unified security strategy. We adapted these by introducing structured Security by Design principles and thus establishing a secure product development process and lifecycle. Product security is now considered throughout all phases of the product lifecycle from the design phase onward. This also took into account that security updates for products must now correspond to the product lifespan. Technology is selected to ensure it can still receive security updates even after 5 years. <\/p>\n

Furthermore, with our support, the company introduced a new Continuous Integration and Continuous Delivery (CI\/CD) pipeline with automated security checks. An Application Security Platform was implemented that automatically reviews developers’ code and reports vulnerabilities in code and libraries during programming. This program can also create the SBOM required by the CRA for all software developed by the company. <\/p>\n

Simultaneously, an Incident Response Team was established within the company and the infrastructure for Incident Response Management and Security Monitoring was created. The company is now able to report vulnerabilities and security incidents within a maximum of 24 hours. It can respond quickly to internal and external reports and provide users with security updates for their products. <\/p>\n

Due to the new processes and the new security mindset, the products now fulfill the Security by Design & Default principles.<\/strong><\/p>\n

Conducting the Conformity Assessment<\/h3>\n

The company had no critical products, so the conformity assessment could be conducted by the company itself; it did not require evaluation by a third party. We supported the company in the self-evaluation and were able to obtain the CE marking for the new products, so that they can enter the EU market without delay after December 2027. <\/p>\n

Added Value<\/h2>\n

Thanks to the in-depth expertise of our CRA Cybersecurity expert team and our many years of experience in Product Security and secure software development, we were able to precisely capture the specific challenges of our client and individual organizational units and develop tailored solutions.<\/p>\n

In addition to our transparent and holistic approach, close customer-oriented communication and flexibility also contributed significantly to success. Through a thorough assessment of the existing maturity level in the departments and comprehensive education about legal requirements, we provided the client with a clear overview and promoted their security awareness. <\/p>\n

At carmasec, we place great value on close collaboration with our clients. Through detailed targeted interviews and the involvement of all relevant stakeholders, we were able to generate a deep understanding of the specific challenges in this project. This enabled us to develop tailored recommendations to ensure compliance with the CRA and other client-specific requirements. We relied on an integrative approach with our Open Source Security experts, which was considered both in strategy development and in the definition of concrete measures. In addition to analysis and assessment, we also supported practical implementation by enabling the client to build sustainable and practical Product Security structures. Together, we defined roles and responsibilities and developed a roadmap for implementing security measures, such as integrating security steps into the development process, defining Secure Coding Standards, and introducing a process for Vulnerability and Incident Management. Additionally, we provided expert consulting support in creating required documentation and processes. <\/p>\n

Within one year, we established the framework conditions for CRA and implemented both a secure development process and comprehensive Vulnerability Management including CRA reporting obligations.<\/p>\n

This spared the client the challenge of recruiting scarce experts and instead enabled them to build internal knowledge in a targeted manner. This allowed them to effectively implement Product Security and set the course for secure products of tomorrow. <\/p>\n\n <\/article>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n

Conclusion<\/h3>\n

Compliance with the Cyber Resilience Act is not a one-time project. It is a structural question. Companies that build security late in the development process pay twice: once for retrofitting, once for lost time. <\/p>\n

This project demonstrates what is possible when starting early. Security by Design as a principle. An SBOM as a foundation. Incident Response as infrastructure. And a team that does not have requirements imposed from outside, but understands why they make sense. <\/p>\n

The result is not a checked-off compliance document. It is a product development process that starts securely from now on. <\/p>\n\n <\/article>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n

FAQ on CRA Implementation in Practice<\/h3>\n\n <\/article>\n <\/div>\n <\/div>\n<\/section>\n\n\n
\n
\n
\n
\n
\n
\n
\n

\n How long does a CRA compliance implementation take? \n <\/p>\n <\/div>\n

\n

That depends on the initial situation. In this project, the complete framework conditions including CE marking were achieved within one year. Companies with a more mature security level can be faster, those with more complex structures require more time. <\/span><\/p>\n<\/div>\n <\/div>\n <\/div>\n

\n
\n

\n Must all company products be CRA-compliant? \n <\/p>\n <\/div>\n

\n

No. The CRA applies to products with digital elements that are placed on the EU market after entry into force. The first step is always the product-specific applicability analysis: What falls under the CRA, what does not? <\/p>\n<\/div>\n <\/div>\n <\/div>\n

\n
\n

\n What is the difference between standard and critical products? \n <\/p>\n <\/div>\n

\n

Standard products can be certified through self-assessment. Class I and II products require external review by a notified body. Classification is based on the product’s risk potential and is defined in the Annex of EU Regulation 2024\/2847. <\/p>\n<\/div>\n <\/div>\n <\/div>\n

\n
\n

\n What does a CRA gap analysis cost? \n <\/p>\n <\/div>\n

\n

Costs depend on the size of the company, the number of affected products, and the complexity of existing processes. We discuss the scope in the initial consultation. <\/p>\n<\/div>\n <\/div>\n <\/div>\n

\n
\n

\n Can carmasec also handle implementation, not just analysis? \n <\/p>\n <\/div>\n

\n

Yes. carmasec accompanies the entire process: from applicability analysis through gap analysis and risk analysis to implementation of technical measures, establishment of SBOM and Incident Response infrastructure, and preparation for conformity assessment. <\/p>\n<\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n\n

\n
\n
\n

Is your team facing similar questions?<\/p>\n

Our team supports you from the initial assessment to CE marking. Competent, direct, and without detours. <\/p>\n

Schedule initial consultation<\/a><\/p>\n\n <\/article>\n <\/div>\n <\/div>\n<\/section>","protected":false},"excerpt":{"rendered":"

How can CRA compliance be achieved when legacy structures, competency gaps, and multiple regulations simultaneously impact an organization? In this article, we demonstrate how a compliance project becomes a fundamental restart of product security. <\/p>\n","protected":false},"author":4,"featured_media":3625,"parent":0,"menu_order":0,"template":"","meta":{"_acf_changed":true},"content-type":[21],"industry":[33,38,35,40],"persona":[27,30,29,28],"topic":[11,13,16],"class_list":["post-3638","knowledge-center","type-knowledge-center","status-publish","has-post-thumbnail","hentry","content-type-case-study","industry-automotive","industry-logistics-transportation","industry-manufacturing-industry","industry-other-industries","persona-ciso-security-leadership","persona-compliance-legal-privacy","persona-dev-devops-engineering","persona-it-operations-infrastructure","topic-information-security-compliance","topic-offensive-security","topic-risk-crisis-management"],"acf":[],"yoast_head":"\nCase Study: Product Security and Cyber Resilience Act Case Study: CRA Compliance in Practice | carmasec - carmasec<\/title>\n<meta name=\"description\" content=\"How an electronics manufacturer achieved CRA compliance within one year. SBOM, Security by Design, Incident Response: The complete implementation roadmap\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Case Study: Product Security and Cyber Resilience Act\" \/>\n<meta property=\"og:description\" content=\"How an electronics manufacturer achieved CRA compliance within one year. SBOM, Security by Design, Incident Response: The complete implementation roadmap\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/\" \/>\n<meta property=\"og:site_name\" content=\"carmasec\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-01T11:10:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.carmasec.com\/wp-content\/uploads\/2026\/04\/caramsec_CRA_CE-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1068\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/\",\"url\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/\",\"name\":\"Case Study: Product Security and Cyber Resilience Act Case Study: CRA Compliance in Practice | carmasec - carmasec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.carmasec.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/caramsec_CRA_CE-1.jpg\",\"datePublished\":\"2026-02-16T10:12:22+00:00\",\"dateModified\":\"2026-06-01T11:10:48+00:00\",\"description\":\"How an electronics manufacturer achieved CRA compliance within one year. SBOM, Security by Design, Incident Response: The complete implementation roadmap\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.carmasec.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/caramsec_CRA_CE-1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.carmasec.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/caramsec_CRA_CE-1.jpg\",\"width\":1920,\"height\":1068,\"caption\":\"Illustration of a robotic gripper hand holding a technically shaped element with CE engraved.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Case Study: Product Security and Cyber Resilience Act\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/\",\"name\":\"carmasec\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Organization\",\"Place\"],\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/#organization\",\"name\":\"carmasec GmbH & Co. KG\",\"alternateName\":\"carmasec\",\"url\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/\",\"logo\":{\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/#local-main-organization-logo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/#local-main-organization-logo\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/carmasec\\\/\"],\"description\":\"Die carmasec GmbH & Co. KG ist eine auf Cybersicherheit und Cyberresilienz spezialisierte Beratungsunternehmen mit Sitz in Essen. Das Leistungsspektrum verbindet zwei essenzielle Welten: strategische Compliance und dem Schutz vor Cyberangriffen. Mit einem klaren Fokus auf agile Sicherheitsprozesse unterst\u00fctzt carmasec Kunden branchenneutral und herstellerunabh\u00e4ngig. Das interdisziplin\u00e4re Team integriert langj\u00e4hrige Beratungserfahrung mit modernen Arbeitsweisen, um komplexe Anforderungen \u2013 von ISMS und Risikomanagement bis hin zu Cloud Security und Offensive Security \u2013 effizient umzusetzen. Zu den Kunden z\u00e4hlen der gehobene Mittelstand sowie internationale Konzerne, insbesondere aus Finanz- und Versicherungswesen, Fertigungsindustrie, Automotive sowie Kritischen Infrastrukturen. Mit der etablierten Veranstaltungsreihe \u201efriends of carmasec\\\" schafft das Unternehmen eine zentrale Plattform f\u00fcr den Branchen-Dialog und vernetzt regelm\u00e4\u00dfig Entscheidungstr\u00e4ger:innen und Expert:innen aus der Security-Community. carmasec bef\u00e4higt Organisationen, Risiken ganzheitlich zu managen und digitale Infrastrukturen proaktiv zu sch\u00fctzen.\",\"legalName\":\"carmasec GmbH & Co. KG\",\"foundingDate\":\"2018-12-18\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":\"11\",\"maxValue\":\"50\"},\"telephone\":[],\"openingHoursSpecification\":[{\"@type\":\"OpeningHoursSpecification\",\"dayOfWeek\":[\"Monday\",\"Tuesday\",\"Wednesday\",\"Thursday\",\"Friday\",\"Saturday\",\"Sunday\"],\"opens\":\"09:00\",\"closes\":\"17:00\"}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.carmasec.com\\\/en\\\/security-knowledge\\\/case-study-product-security-and-cyber-resilience-act\\\/#local-main-organization-logo\",\"url\":\"https:\\\/\\\/www.carmasec.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/logo-carmasec.svg\",\"contentUrl\":\"https:\\\/\\\/www.carmasec.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/logo-carmasec.svg\",\"width\":299,\"height\":40,\"caption\":\"carmasec GmbH & Co. KG\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Case Study: Product Security and Cyber Resilience Act Case Study: CRA Compliance in Practice | carmasec - carmasec","description":"How an electronics manufacturer achieved CRA compliance within one year. SBOM, Security by Design, Incident Response: The complete implementation roadmap","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/","og_locale":"en_US","og_type":"article","og_title":"Case Study: Product Security and Cyber Resilience Act","og_description":"How an electronics manufacturer achieved CRA compliance within one year. SBOM, Security by Design, Incident Response: The complete implementation roadmap","og_url":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/","og_site_name":"carmasec","article_modified_time":"2026-06-01T11:10:48+00:00","og_image":[{"width":1920,"height":1068,"url":"https:\/\/www.carmasec.com\/wp-content\/uploads\/2026\/04\/caramsec_CRA_CE-1.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/","url":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/","name":"Case Study: Product Security and Cyber Resilience Act Case Study: CRA Compliance in Practice | carmasec - carmasec","isPartOf":{"@id":"https:\/\/www.carmasec.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/#primaryimage"},"image":{"@id":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/#primaryimage"},"thumbnailUrl":"https:\/\/www.carmasec.com\/wp-content\/uploads\/2026\/04\/caramsec_CRA_CE-1.jpg","datePublished":"2026-02-16T10:12:22+00:00","dateModified":"2026-06-01T11:10:48+00:00","description":"How an electronics manufacturer achieved CRA compliance within one year. SBOM, Security by Design, Incident Response: The complete implementation roadmap","breadcrumb":{"@id":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/#primaryimage","url":"https:\/\/www.carmasec.com\/wp-content\/uploads\/2026\/04\/caramsec_CRA_CE-1.jpg","contentUrl":"https:\/\/www.carmasec.com\/wp-content\/uploads\/2026\/04\/caramsec_CRA_CE-1.jpg","width":1920,"height":1068,"caption":"Illustration of a robotic gripper hand holding a technically shaped element with CE engraved."},{"@type":"BreadcrumbList","@id":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/www.carmasec.com\/en\/"},{"@type":"ListItem","position":2,"name":"Case Study: Product Security and Cyber Resilience Act"}]},{"@type":"WebSite","@id":"https:\/\/www.carmasec.com\/en\/#website","url":"https:\/\/www.carmasec.com\/en\/","name":"carmasec","description":"","publisher":{"@id":"https:\/\/www.carmasec.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.carmasec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Organization","Place"],"@id":"https:\/\/www.carmasec.com\/en\/#organization","name":"carmasec GmbH & Co. KG","alternateName":"carmasec","url":"https:\/\/www.carmasec.com\/en\/","logo":{"@id":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/#local-main-organization-logo"},"image":{"@id":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/#local-main-organization-logo"},"sameAs":["https:\/\/www.linkedin.com\/company\/carmasec\/"],"description":"Die carmasec GmbH & Co. KG ist eine auf Cybersicherheit und Cyberresilienz spezialisierte Beratungsunternehmen mit Sitz in Essen. Das Leistungsspektrum verbindet zwei essenzielle Welten: strategische Compliance und dem Schutz vor Cyberangriffen. Mit einem klaren Fokus auf agile Sicherheitsprozesse unterst\u00fctzt carmasec Kunden branchenneutral und herstellerunabh\u00e4ngig. Das interdisziplin\u00e4re Team integriert langj\u00e4hrige Beratungserfahrung mit modernen Arbeitsweisen, um komplexe Anforderungen \u2013 von ISMS und Risikomanagement bis hin zu Cloud Security und Offensive Security \u2013 effizient umzusetzen. Zu den Kunden z\u00e4hlen der gehobene Mittelstand sowie internationale Konzerne, insbesondere aus Finanz- und Versicherungswesen, Fertigungsindustrie, Automotive sowie Kritischen Infrastrukturen. Mit der etablierten Veranstaltungsreihe \u201efriends of carmasec\" schafft das Unternehmen eine zentrale Plattform f\u00fcr den Branchen-Dialog und vernetzt regelm\u00e4\u00dfig Entscheidungstr\u00e4ger:innen und Expert:innen aus der Security-Community. carmasec bef\u00e4higt Organisationen, Risiken ganzheitlich zu managen und digitale Infrastrukturen proaktiv zu sch\u00fctzen.","legalName":"carmasec GmbH & Co. KG","foundingDate":"2018-12-18","numberOfEmployees":{"@type":"QuantitativeValue","minValue":"11","maxValue":"50"},"telephone":[],"openingHoursSpecification":[{"@type":"OpeningHoursSpecification","dayOfWeek":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"],"opens":"09:00","closes":"17:00"}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.carmasec.com\/en\/security-knowledge\/case-study-product-security-and-cyber-resilience-act\/#local-main-organization-logo","url":"https:\/\/www.carmasec.com\/wp-content\/uploads\/2026\/02\/logo-carmasec.svg","contentUrl":"https:\/\/www.carmasec.com\/wp-content\/uploads\/2026\/02\/logo-carmasec.svg","width":299,"height":40,"caption":"carmasec GmbH & Co. KG"}]}},"_links":{"self":[{"href":"https:\/\/www.carmasec.com\/en\/wp-json\/wp\/v2\/knowledge-center\/3638","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.carmasec.com\/en\/wp-json\/wp\/v2\/knowledge-center"}],"about":[{"href":"https:\/\/www.carmasec.com\/en\/wp-json\/wp\/v2\/types\/knowledge-center"}],"author":[{"embeddable":true,"href":"https:\/\/www.carmasec.com\/en\/wp-json\/wp\/v2\/users\/4"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.carmasec.com\/en\/wp-json\/wp\/v2\/media\/3625"}],"wp:attachment":[{"href":"https:\/\/www.carmasec.com\/en\/wp-json\/wp\/v2\/media?parent=3638"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.carmasec.com\/en\/wp-json\/wp\/v2\/content-type?post=3638"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/www.carmasec.com\/en\/wp-json\/wp\/v2\/industry?post=3638"},{"taxonomy":"persona","embeddable":true,"href":"https:\/\/www.carmasec.com\/en\/wp-json\/wp\/v2\/persona?post=3638"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.carmasec.com\/en\/wp-json\/wp\/v2\/topic?post=3638"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}