Police Cyber Incident Highlights Why Business...
Cyber incidents can disrupt much more than IT systems. This article looks at what organisations can learn from the recent...
Read More
AJC has partnered with Capital Compass to provide organisations with practical support in preparing for and complying with the EU Cyber Resilience Act (CRA). The partnership brings together complementary expertise, resources and delivery capability, allowing us to support organisations throughout their CRA compliance journey, from understanding whether products fall within scope and assessing existing controls through to addressing identified gaps, strengthening cyber security arrangements and preparing for conformity assessment.
For organisations operating across European markets, the partnership provides access to cyber security, risk and compliance expertise alongside established knowledge of the European business and regulatory environment.
Capital Compass is part of J Kabir & Associates, a consultancy firm based in Luxembourg with a strong presence across the Benelux region. The organisation brings decades of experience supporting businesses, together with valuable knowledge of the European business and regulatory environment.
AJC brings specialist expertise across cyber security, risk, resilience and regulatory compliance. By working together, AJC and Capital Compass can provide clients with a broader range of knowledge, specialist resources and practical delivery support through a collaborative approach. The partnership is particularly relevant to organisations that develop, manufacture, import, distribute or supply digital products into the European market and need support understanding how the CRA applies to their operations.
The Cyber Resilience Act introduces a significant new set of cyber security obligations for organisations involved in products with digital elements. For many businesses, compliance will not be achieved through a single policy or technical change. It may require organisations to review product development processes, cyber security risk management, vulnerability handling, incident reporting, technical documentation, third-party components and ongoing security support.
Businesses operating outside the EU may also be affected where their products are made available on the European market. The partnership between AJC and Capital Compass is designed to give organisations access to both the specialist expertise and practical support needed to understand these requirements and translate them into achievable actions, while also drawing on an established European presence when navigating a regulation that applies across the EU market.
The Cyber Resilience Act introduces mandatory cyber security requirements for products with digital elements. Its aim is to ensure that connected hardware and software products are designed securely, remain secure throughout their expected lifetime and are supported by appropriate vulnerability management and security updates.
The CRA entered into force on 10 December 2024, with its requirements being introduced in phases. Vulnerability and incident reporting obligations became applicable from September 2026, while most of the remaining obligations will apply from December 2027. Importantly, the CRA is not limited to organisations headquartered within the EU. Businesses elsewhere may also be affected where they develop, manufacture, import, distribute or supply in-scope products to the European market.
This means organisations should establish whether the regulation applies to them well before the December 2027 deadline and understand what changes may be required across their products, processes and security arrangements.
Through the partnership, AJC and Capital Compass can provide practical support tailored to an organisation’s products, responsibilities and current level of readiness.
We can help organisations identify which products and activities fall within scope, determine whether they are acting as a manufacturer, importer or distributor, understand the relevant product classification and establish the appropriate conformity assessment route. A readiness assessment can then compare existing arrangements against CRA requirements and identify areas requiring further work.
We can review existing cyber security and vulnerability management arrangements, including cyber security risk assessments, secure development processes, third-party and open-source components, security testing, vulnerability identification and remediation, vulnerability disclosure processes, security updates and ongoing product support. This helps organisations understand whether their existing controls are sufficient and where additional measures may be required.
The CRA’s vulnerability and incident reporting requirements are already in force. AJC and Capital Compass can review whether organisations have appropriate processes for monitoring, escalation, decision-making and regulatory reporting, including whether teams are able to respond within the required reporting timescales. This can help identify practical gaps before a reportable vulnerability or incident occurs.
Our support can also extend to technical documentation and supporting evidence. We can help organisations review whether the evidence needed to demonstrate compliance is being produced and maintained, and support preparation for conformity assessment, including engagement with a notified body where required.
Where gaps are identified, clients can receive a practical, prioritised remediation roadmap setting out the actions needed to improve readiness. This allows organisations to focus resources on the areas that matter most and build CRA requirements into existing product development, cyber security and compliance processes rather than treating them as a separate exercise closer to the deadline.
The Cyber Resilience Act will affect organisations in different ways depending on the products they provide, their role within the supply chain and their existing cyber security arrangements. By combining AJC’s cyber security, risk and compliance expertise with Capital Compass’s European presence, regulatory knowledge and additional specialist resources, the partnership gives clients access to a broader range of support as they prepare for the CRA.
The aim is to make the compliance process more manageable, helping organisations understand what applies to them, identify where improvements are needed and take practical steps towards meeting the relevant requirements.
Want to understand how the Cyber Resilience Act could affect your organisation?
Download our CRA brochure here, or contact us to discuss your requirements.
Cyber incidents can disrupt much more than IT systems. This article looks at what organisations can learn from the recent...
Read More
Financial crime compliance can create significant operational pressure for payments firms, particularly when workloads increase, remediation is required or specialist...
Read More
In this series, we introduce the people behind AJC and the experience they bring to the business. In this profile,...
Read More