Cookies on AIGROW

We use necessary cookies to run the site. With your permission, we also use cookies for analytics, session recordings and marketing attribution.

Cookie Policy

Cyber Resilience Act kit: your 24-hour reporting procedure, disclosure policy, security.txt and SBOM

$1,490Fixed price, paid onceDelivered within 5 working days of your answers

Order for $1,490How it works

Every duty and deadline cites its article. Delivered as listed, or refunded in full.

AIGROW prepares your Cyber Resilience Act kit for $1,490, paid once: the procedure for the reporting duty in force since 11 September 2026, with its 24-hour early warning, a coordinated vulnerability disclosure policy, a security.txt file, a software bill of materials for one product and a calendar of your obligations to 11 December 2027.

What the Cyber Resilience Act kit does, and what it does not

Since 11 September 2026, a manufacturer that becomes aware of an actively exploited vulnerability or a severe incident in its product must send an early warning within 24 hours through the single reporting platform run by ENISA. The rest of the Regulation applies from 11 December 2027.

What it does
  • Writes your procedure for the reporting duty: who decides, who submits, the early warning within 24 hours, the notification within 72 hours and the final report, with a template for each
  • Names the CSIRT your reports go to, set by the EU country where decisions about your product security are mostly taken, and the steps on the ENISA platform
  • Writes a coordinated vulnerability disclosure policy for your site, and a security.txt file (RFC 9116) that gives researchers your contact address and links to the policy
  • Builds a software bill of materials for one product in CycloneDX or SPDX, from the dependency files you send
  • Lists the obligations that apply to you up to 11 December 2027 as a dated calendar, each with its article
What it does not do
  • It is not legal advice: we prepare the documents from your answers and the text of the Regulation, and where your answers leave it unclear whether a product is in scope, we say so for a lawyer to confirm
  • It does not submit reports for you, watch your product for vulnerabilities or test its security
  • It does not cover the conformity assessment, technical documentation, EU declaration of conformity or CE marking due from 11 December 2027: the calendar lists them so you can plan them
  • It does not guarantee that an authority will find your product compliant

From payment to the finished kit

Each step and when it happens. We work from your written answers, so there is no call to book.

Pay at checkoutPay once by card at the Stripe checkout. Stripe sends the receipt.2 minutes
Answer the questionnaireWe email it straight after payment. Reply with your answers and the dependency files of the product.30 to 60 minutes
Receive the kitThe reporting procedure and its templates, the disclosure policy, security.txt, the SBOM and the calendar, each duty with its article.Within 5 working daysAfter your answers
Ask for changesSend your notes on any document and we return the corrected kit. You then publish the policy and security.txt on your site.Within 3 working daysAfter your notes

One company, one product, one price

Paid once at checkout, which asks for your email and card. Right after payment we email you a written questionnaire about your company, your product and how you handle security reports today; the kit arrives within 5 working days of your answers.

What we need from you

Answer our written questionnaire: your company and the EU country where decisions about your product security are taken, the product and where it is sold, who handles security reports today, the address researchers should write to, and the product dependency files, such as a lockfile or a component list for firmware.

What you receive

  • The reporting procedure for actively exploited vulnerabilities and severe incidents: roles, the 24-hour, 72-hour and final report deadlines, the CSIRT and ENISA steps, and a template for each report
  • A coordinated vulnerability disclosure policy, ready to publish on your site
  • A security.txt file (RFC 9116) with your contact address, expiry date and policy link, ready for /.well-known/security.txt
  • A software bill of materials for one product in CycloneDX or SPDX JSON, covering at least its top-level dependencies
  • A calendar of your obligations up to 11 December 2027, each with its article in Regulation (EU) 2024/2847
  • Editable documents in English or in any of the 11 languages of this site, with one round of changes

Cyber Resilience Act kit

$1,490

Paid once at checkout. No subscription, nothing renews.

If we do not deliver what this page lists, or you change your mind before work starts, you get a full refund.

Why buy it from AIGROW

What you can check before you pay, and after the work.

A fixed price
$1,490, paid once. No subscription, nothing renews. Everything included is listed on this page before you pay.
Proof you can check
Every duty and deadline in the kit cites its article in Regulation (EU) 2024/2847, so you can check each one against the text published on EUR-Lex.
A public method
The free security.txt checker reads the file on your site against RFC 9116, the same checks we run on the file in the kit, and gives you a corrected copy. Run the security.txt checker

Before you buy

Who the Regulation covers, what the reporting duty asks, and what the kit leaves to you.

It applies to manufacturers: anyone who develops or manufactures a product with digital elements, or has one made, and markets it under their own name or trademark, for payment or free of charge. Such a product is software or hardware that connects to a device or network. Importers and distributors have duties of their own.

Yes. Article 14 has applied since 11 September 2026, and it covers products placed on the market before the rest of the Regulation applies on 11 December 2027. ENISA launched the single reporting platform on 11 September 2026.

For an actively exploited vulnerability: an early warning within 24 hours of becoming aware of it, a notification within 72 hours, and a final report no later than 14 days after a fix or mitigation is available. For a severe incident: the same 24 and 72 hours, and a final report within one month of the notification.

A website or a cloud service on its own is outside the Regulation. Software you ship to users, such as a desktop or mobile app, is a product under it, and so are the cloud functions a product needs to work, such as the service that lets users control a smart device from a distance.

No. Reports go through the ENISA single reporting platform from the person you name, who signs in with an EU Login account. The procedure says who that is, and the templates hold what each report must contain, so the person on duty fills them in and submits.

The dependency files of the product, such as package-lock.json, poetry.lock, go.sum or Cargo.lock, or for firmware a list of components with their versions. We build the SBOM from those files, so we need no access to your repository or systems.

The procedure, the policy and security.txt cover your company. The price includes the SBOM for one product: list the others in the questionnaire and we quote their SBOMs before any work starts. If we do not deliver what this page lists, you get a full refund.

If you also run services under NIS2

A company that sells cloud, managed IT or managed security services in the EU may also be covered by the NIS2 Directive. Our NIS2 readiness pack checks whether it is, marks the ten security measures of Article 21 and writes the starter policies.

See the NIS2 readiness pack

The service that fits next

$290

DMARC setup

We give you the exact SPF, DKIM and DMARC records and raise DMARC to quarantine or reject in steps, reading the reports for 30 days.

See DMARC setup

Have the 24-hour reporting procedure written before you need it.

Pay once, answer the written questionnaire, and receive the procedure, the policy, security.txt, the SBOM and the calendar within 5 working days.

Order for $1,490See every done-for-you service

$1,490 · paid once · delivered as listed or refunded