Cyber Resilience Act (CRA) - Readiness Assessment

Deloitte’s CRA Readiness Assessment provides a decision-oriented view of an organization’s current level of maturity in relation to the Cyber Resilience Act, including transparency on how AWS-supported capabilities could contribute to compliance readiness.

The service establishes transparency on existing setup, capabilities, processes, methods, tools, and controls, highlights remaining gaps, and defines priority action areas. It can also consider whether AWS-supported services are properly addressed. This creates a solid foundation for subsequent compliance and enablement activities.

The assessment focuses on the organizational and operational capabilities most relevant for CRA execution, including, among others, governance and ownership, secure development practices, supplier management, vulnerability handling, and product-related documentation and evidence. Where applicable, AWS-supported services are considered as part of these tools and capabilities.

Deloitte uses a structured, pragmatic approach tailored to the client’s business model, product landscape, and organizational setup. This also reflects the organization’s use of AWS services and cloud architecture within the CRA scope. Rather than a theoretical exercise, the assessment is designed to enable informed management decisions.

The result is a fact-based and actionable view of current strengths, gaps, and priorities, enabling organizations to transition from assessment to targeted remediation and broader CRA enablement.