CBAM Data Readiness
Turn scattered plant data into an emissions file your EU importer can use, and know whether actual values are worth the effort.
EU market access for exporters
CRA Incident Readiness
Be able to show, within hours, who decides, what gets reported and to whom when a product vulnerability is exploited.
Why now
If an exploited vulnerability surfaced on a Friday night, could we meet the 24-hour clock?
Reporting obligations under the EU Cyber Resilience Act began on 11 September 2026. For actively exploited vulnerabilities and severe incidents, manufacturers owe an early warning within 24 hours and a notification within 72 hours.
Who it is for
Turkish manufacturers of connected devices, industrial equipment and commercial software sold in the EU, usually led by the product, technology or quality head.
You may need this if
- Several products and firmware versions are supported in the EU, but no one owns product incidents.
- IT security is in place, yet product incidents follow no rehearsed path.
- Release and component information is hard to assemble quickly.
What you leave with
- A clear map of which products and versions are in scope
- Named roles and an escalation path for product incidents
- Prepared reporting drafts that fit the CRA timeline
- Evidence from a realistic exercise, with gaps ranked by consequence
How we start
A tabletop exercise on one product family against the 24- and 72-hour timeline, followed by a scoped readiness plan.
Scope and boundaries
We do not certify products, run round-the-clock incident response, or take over the manufacturer’s reporting duty. EU legal advice is appointed separately where needed.
Whitepaper
The 24-hour test: CRA incident readiness for manufacturers selling into the EU
Read the whitepaperA useful first conversation
Bring the decision. We’ll start there.
Tell us what you are considering and what makes it difficult. We’ll clarify the question, assess fit, and discuss a practical scope.