Services
Supplier and component due diligence (CRA)
An assessment of the third-party components in your product and the suppliers behind them — open source, commercial libraries, operating systems, firmware and parts developed for you — so you know what each one brings into the product, what to require from its supplier, and how to keep it supported, as CRA Article 13(5) and IEC 62443-4-1 SM-9 and SM-10 expect.
Who it is for
Most products with digital elements are largely made of other people’s code: open-source libraries, an operating system, vendor firmware, an SDK, a module a supplier built for you. The CRA makes the manufacturer responsible for all of it. This package is for teams that need to show how they chose and checked those components, get SBOMs and vulnerability notifications from their suppliers, and line up their suppliers’ support with their own support period.
What the package establishes
- An inventory of components and suppliers, classified by type — open source, commercial, firmware, custom-developed, CE-marked — because the type decides what you can ask for and what you can rely on.
- Risk tiers, so the depth of each assessment follows what the component can do in your product: full checks for the few critical components, automated checks for the many ordinary ones.
- A supplier questionnaire built around the CRA: SBOMs, support periods, update delivery and integrity, vulnerability handling, and how quickly suppliers tell you about actively exploited vulnerabilities — fast enough for your own 24-hour reporting clock.
- An assessment and decision record for each critical component: accept, accept with conditions, replace or mitigate in your product, approved by someone other than the person who proposed it.
- A contract clause checklist for your lawyer, the route for reporting vulnerabilities you find to a component’s maintainer, and a plan for reassessing suppliers over the support period.
The outcome
You can show, component by component, how you exercised due diligence: what you use, why, what you checked, what you required from the supplier and what you decided. Supplier SBOMs and advisories feed your vulnerability monitoring, and supplier commitments line up with your support period and reporting deadlines. The package supports evidence for CRA Article 13(5) and (6) and Annex I Part II (1). It does not establish CRA conformity.
Usage terms
You may adapt the templates and use them within your organisation indefinitely, including after any engagement with us ends. The questionnaires you send and the records you complete are yours: share them with suppliers, auditors, authorities or customers. The templates themselves, in template form, whether unchanged or adapted, may not be resold, redistributed or published.
What it is not
- It covers the components in your product, not organisational suppliers such as IT services, cloud providers or data processors under ISO/IEC 27001 or NIS2.
- It does not provide contract wording or legal advice: the clause checklist is for your lawyer.
- It does not certify suppliers or components, and it does not establish CRA conformity.
- Monitoring your components for new vulnerabilities is part of the CRA vulnerability handling package. See the service packages
How it starts
- 01
Describe the product and its supply chain
Tell us what you build and roughly what is inside: open source, commercial libraries, an operating system, vendor firmware, parts developed by suppliers.
- 02
Pick the critical components together
We agree the tier criteria and go through your SBOM or component list, so the detailed work goes where the risk is.
- 03
Assess and decide
Questionnaires go to the suppliers of the critical components; we assess the answers with you and record a decision and its conditions for each.
Get in touch
Know what is inside your product
Describe your product and the components you rely on most. We will come back with a sensible scope: which components to assess first and what to ask their suppliers.
We reply within two working days.
Full contact detailsOpens our scheduling page in a new tab — pick a slot that suits you.
Worth including in a first message
- What you build, and whether you have an SBOM for it today.
- Which components you depend on most — operating system, firmware, commercial SDKs, parts built by suppliers.
- What is driving this — CRA preparation, a customer audit, or a supplier that will not provide an SBOM.
Please keep a first message free of confidential technical detail and trade secrets. Once we reply we can agree an encrypted channel for anything sensitive.