ENISA launches SME-focused practical guidance for complying with CRA

The European Union Agency for Cybersecurity (ENISA) has published a new SME Cyber Resilience Maturity Assessment Model to help smaller businesses evaluate and strengthen cybersecurity as required by the Cyber Resilience Act.

The practical guidance offers structured advice tailored to SMEs' needs.

While primarily designed for businesses that manufacture and sell products with digital elements, other smaller businesses lacking in resources and expertise can also use it to implement the CRA. 

The maturity model focuses on five key domains: 

• Governance and documentation
• Risk management and security by design and default 
• Vulnerability and patch management 
• Product life cycle management
• Awareness, competence, and skills

Each domain contains five maturity criteria, with organisations categorised into basic, intermediate, or advanced maturity profiles. This classification reflects how consistently product-related risks are managed, helping firms proactively improve their security practices and systematically align with the CRA over time.

Training Announcement: The BCS Foundation Certificate in Information Security Management Principles (CISMP) is an entry-level programme aligned with ISO/IEC 27001 and Cyber Essentials that examines the fundamental concepts, technologies and principles of information security management. It provides attendees with practical knowledge of key concepts and techniques in risk management, security operations, and technical, physical, and environmental security. In addition, CISMP addresses legal and regulatory requirements, business continuity and disaster recovery planning, and emerging technologies. Find out more.