Question 1

What is the EU Cyber Resilience Act (CRA)?

Accepted Answer

The Cyber Resilience Act (CRA) is EU regulation that mandates cybersecurity requirements for products with digital elements. It covers software, firmware, and connected hardware sold in the EU, requiring measures such as a Software Bill of Materials (SBOM), at least five years of security updates, coordinated vulnerability disclosure, secure-by-default design, and CRA-compliant CE marking.

Question 2

Does the CRA apply to my product?

Accepted Answer

The CRA generally applies if your product connects to another device or network (Wi-Fi, Bluetooth, USB, or API), is software or firmware sold commercially, is a hardware component used inside a connected product, or connects indirectly as part of a larger connected system. Products already regulated as medical devices, vehicles, aviation, or marine equipment are typically out of scope.

Question 3

How does SPS Digital Tech help Danish companies with CRA compliance?

Accepted Answer

SPS Digital Tech helps Danish companies navigate CRA compliance from scoping to certification. This includes a discovery audit to identify security gaps and CRA misalignments, a custom security blueprint, and deployment oversight to reach a fully compliant, CE-markable state.

Question 4

What services does SPS Digital Tech offer?

Accepted Answer

SPS Digital Tech focuses on EU Cyber Resilience Act (CRA) compliance: scoping and gap analysis to determine whether your products are in scope, secure-by-design engineering and Software Bill of Materials (SBOM) management, coordinated vulnerability handling with 24-hour incident reporting, and technical documentation and conformity assessment for CRA-compliant CE marking. Engagement models range from a complimentary strategic discovery session to deployment oversight, an ongoing compliance programme lead, and ad-hoc audit and reporting support.

Question 5

Who founded SPS Digital Tech?

Accepted Answer

SPS Digital Tech was founded by Stephan Smuts, a Strategic Security Architect who combines elite international expertise with a deep understanding of the Danish market to deliver practical, high-integrity security solutions.

Six questions. Six yes-or-no answers.

First: what is your role?

Can anyone list what is in your latest release within an hour, without a developer?

Does every security alert get a decision within two working days?

Can a fix reach every product within days, and can a bad update be stopped halfway?

Does a test alarm on a Friday at 17:00 end with a report ready in time?

Does every serious risk have a name, a decision and a review date?

Is every critical part supported for at least as long as you promise your customers?