SPS Digital Tech
Since 11 September 2026, actively exploited vulnerabilities must be reported within 24 hours.Find your CRA gaps

The Six Systems for the Cyber Resilience Act (CRA)

Six systems that keep you CRA‑compliant, week after week.

The CRA says what must be true about your connected product. It doesn't say how to run your company so it stays true. The Six Systems are our answer: six routines, built on things you already do, that turn everyday work into the evidence the CRA asks for.

The CRA is an EU requirement. The six systems are our way of meeting it.

Two free checks, in this order:

Does the CRA apply to my product?Find your CRA gaps (6 questions, 2 min)
or book a consultation
The law asksYou runYou can show
Know what's insideA parts list from every buildUp-to-date SBOM
Fix flaws for yearsScanner + weekly triageVulnerability log
Safe, free updatesSigned, staged, with a stop buttonUpdate records
Report within 24hsecurity@, on-call, templateReports on time
Assess and own the risksOne owner, risks with datesRisk register
Suppliers coveredSupport end dates in writingSupplier promises

Numbers match the six systems below.

The Six Systems

Built on what you already run.

Know what's insideYour build pipeline produces a parts list with every build, giving you an up-to-date SBOM.
You already haveYour build pipeline
We add the routineA parts list from every build
CRA evidence you getUp-to-date SBOM
Read about this system
Watch and fixYour bug tracker gets a scanner and a 30-minute weekly triage, giving you a vulnerability log.
You already haveYour bug tracker
We add the routineScanner + 30-min weekly triage
CRA evidence you getVulnerability log
Read about this system
Ship updates safelyYour release process ships updates signed, staged and with a stop button, giving you update records.
You already haveYour release process
We add the routineSigned, staged, with a stop button
CRA evidence you getUpdate records
Read about this system
Report within 24hYour support inbox gets security@, an on-call rota and a template, so reports go out on time.
You already haveYour support inbox
We add the routinesecurity@, on-call, template
CRA evidence you getReports on time
Read about this system
Decide and ownYour management meeting names one owner and puts dates on risks, giving you a risk register.
You already haveYour management meeting
We add the routineOne owner, risks with dates
CRA evidence you getRisk register
Read about this system
Suppliers in writingYour contracts folder gets support end dates and warnings on paper, giving you supplier promises.
You already haveYour contracts folder
We add the routineEnd dates and warnings on paper
CRA evidence you getSupplier promises
Read about this system

Which of the six do you already have?

Find your CRA gaps (6 questions, 2 min)

Our Services

From hands-on CRA consulting to leadership guidance, training and product integration - we help you build compliance that fits how your business already works.

Practical Consulting

Hands-on CRA scoping, gap analysis and prioritised roadmaps that map directly onto your products and release cycle.

Leadership Consulting

Strategic guidance for founders and leadership teams - clear decisions on risk, investment and compliance ownership.

Training & Development

Practical upskilling so your teams understand CRA obligations and can sustain secure practices day to day.

SaaS Product Integration

Integrating SBOM, vulnerability handling and secure update tooling into your product stack without slowing delivery.

If it applies, how ready are we?

You already have systems in place. Do they keep you CRA‑compliant?

Six quick yes-or-no questions show where your current way of working already meets the CRA, and where it falls short.

Answer six quick questions
Not sure the CRA applies to your product? Check that first

It has already happened

Eight real incidents, and what the CRA now asks.

From August 2016The camera above the front doorIt worked perfectly. For weeks it also had a second owner.Read the story (3 min)January 2016The thermostat that went cold3 a.m. in January. The radiator under the window was cold.Read the story (3 min)December 2020The supplier who stopped answering"Nobody looks after that software anymore. There won't be a fix."Read the story (3 min)
All eight stories

Meet the founder of SPS Digital Tech

You didn't start your company to become a security expert. You want to focus on the work that actually grows your business and trust that security is handled. That is the part I am here to take off your plate.

Book a ConsultationRead more about SPS Digital Tech
Stephan Smuts

Stephan Smuts

Founder & Strategic Security Architect