Record of Processing Activities
Transfer Impact Assessment
Privacy Impact Assessment
Cybersecurity Controls
Cybersecurity Risk Management
Asset Inventory Management
Interactive Awareness Program
EU Cyber Resilience Act (CRA)
The CRA framework is available free of charge through the OSCRAT project, an open-source tool co-funded by the European Union and hosted on Unicis infrastructure. Designed for startup and SME manufacturers to meet CRA requirements from 11 December 2027.
Provided through the OSCRAT project, hosted on Unicis infrastructure. OSCRAT is a separate, free tool and is not part of the Unicis Platform subscription plans.
Cybersecurity requirements for
products with digital elements
The EU Cyber Resilience Act (CRA) sets horizontal cybersecurity requirements for products with digital elements placed on the EU market, covering security by design, vulnerability handling, documentation, and reporting. The main obligations apply from 11 December 2027, and it affects manufacturers, importers, and distributors of hardware and software.
OSCRAT (Open-Source Cyber Resilience Act Tools) is a project co-funded by the European Union that delivers low-cost, open-source tools to help European SMEs prepare for the CRA. It is designed for startup and SME manufacturers. Unicis is a project partner and hosts OSCRAT on Unicis infrastructure.
The CRA framework is provided through the OSCRAT project. It is free to use and does not require a Unicis subscription.
Check if the CRA applies to your product
Run the free CRA Applicability Check on OSCRAT, then manage your CRA work in one open-source platform.
What OSCRAT helps you manage
OSCRAT brings the main CRA activities together in one tool, with automation to reduce manual work.
Applicability
Check whether the CRA applies to your product and which category it falls into.
Checklist Automation
Automated CRA checklists that guide your team through the requirements and track progress.
Configuration Management
Security compliance and configuration assessment using OpenSCAP to verify how your systems are configured.
SBOMs
Manage software bills of materials for your products with digital elements.
Vulnerabilities & Incidents
Track vulnerabilities and prepare for CRA reporting of actively exploited vulnerabilities and severe incidents.
Risk & Documentation
Assess product cybersecurity risk and keep technical documentation and evidence in one place.
Why use OSCRAT for the CRA
Free to use
Created for European SMEs that need CRA readiness without an enterprise budget.
Open source
Open-source tools you can inspect, including OpenSCAP-based configuration assessment, hosted on Unicis infrastructure.
Co-funded by the EU
Built by a consortium of European SMEs and research institutes.
OSCRAT platform and resources
OSCRAT platform
Access the free OSCRAT platform.
CRA Applicability Check
Find out whether the CRA applies to your product.
User manual
Step-by-step guide to using OSCRAT (PDF).
Full documentation
Complete OSCRAT product documentation (PDF).
Conformity Assessment Guide
Guidance on CRA conformity assessment (PDF).
GitHub repository
Open-source code for OSCRAT.
Co-funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Cybersecurity Industrial, Technology and Research Competence Centre. Neither the European Union nor the granting authority can be held responsible for them. – Project: 101190180.
Who should use it?
Startup and SME manufacturers of products with digital elements, plus importers, distributors, and open-source maintainers preparing for CRA obligations from 11 December 2027.
Multi-Framework Support
14 Compliance Frameworks Supported
From the minimum viable security baseline to enterprise-grade standards — coverage for every compliance requirement.
Start your CRA preparation with OSCRAT
Free, open source, and co-funded by the European Union. Hosted on Unicis infrastructure.