Skip to content
ReadinessNavigator
EnglishDeutsch

Services · Coming soon

Product and OT security due diligence

Planned: an independent view of a manufacturer’s product security, development lifecycle and OT environment for a transaction, with the CRA gaps a buyer would inherit and what closing them is likely to involve.

Whoever buys a manufacturer buys its CRA obligations

Since 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products, including products already on the market. From 11 December 2027 the full Cyber Resilience Act applies. When a company changes hands, these obligations stay with its products. A product security gap found after closing becomes an integration cost; found before signing, it can be priced, disclosed or made a condition.

Two variants

For buyers

Red-flag review during the transaction

A focused review in the time a deal allows, based on the data room, management interviews and sampled evidence.

  • Findings rated by their relevance to the deal, each with the evidence behind it and what could not be seen
  • Effort and cost ranges for closing the gaps, before and after December 2027
  • Input for your lawyers on warranties, disclosures and conditions
  • Optional after closing: a confirmatory review with full access and a 100-day plan
For sellers

Readiness before the sale

Ideally six to twelve months before the sale process starts, with full access and no deal deadline.

  • What a buyer’s due diligence team is likely to find, found first
  • A plan for what to fix before the sale, what to disclose and what can wait
  • Support while the gaps are closed
  • The evidence prepared the way due diligence teams ask for it

What we look at

  • Products and CRA position

    Product inventory, CRA classification, support periods, conformity route, technical documentation, and older products still being sold.

  • Secure development lifecycle

    How products are designed, built, tested and released, against IEC 62443-4-1, including the scope and validity of any certificate held.

  • Vulnerability handling and reporting

    SBOMs per release, monitoring, triage records, disclosure policy and security contact, and readiness for the CRA reporting deadlines.

  • OT environment

    Production networks, segmentation, remote service access, legacy systems, backup and recovery, using IEC 62443 concepts; NIS2 status where it applies.

  • IT, as far as it matters

    Identity and access, recovery and incident response, and the cloud services the products depend on. Full IT due diligence stays with an IT due diligence provider.

Evidence, not impressions

Every finding names the documents, interviews or samples it rests on, and every report says what could not be seen. Before signing, we review documents and talk to the people responsible; we do not scan or test the target’s systems without its written agreement.

Independent by design

We work for one side of a transaction only and never for two competing bidders. Our fees never depend on whether the deal closes or at what price, and confidentiality is agreed before any information is shared.

What it is not

  • It is not legal advice: your lawyers assess the exposure and draft the contract terms.
  • It is not a penetration test, an audit or a certification.
  • It is not full IT due diligence or a valuation.
  • It does not establish CRA conformity.

Get in touch

Planning a transaction?

Tell us whether you are buying or selling, what the company builds and your timeline. We will come back with how we would approach it and whether the planned service fits.

We reply within two working days.

Full contact details
consulting@readinessnavigator.com
Write to us
Book a 30-minute call

Opens our scheduling page in a new tab — pick a slot that suits you.

Worth including in a first message

  • Whether you are buying, selling or preparing a sale, and roughly when.
  • What the company builds: products with software, machines, components, or a mix.
  • Which areas matter most to you: products, development, OT, or all of them.
  • Please leave out company names and deal details in a first message; we agree confidentiality before anything sensitive is shared.

Please keep a first message free of confidential technical detail and trade secrets. Once we reply we can agree an encrypted channel for anything sensitive.