The European Union Agency for Cybersecurity (ENISA) has released a practical Cyber Resilience Maturity Assessment Model to help SMEs prepare for the Cyber Resilience Act (CRA) before it becomes fully applicable in December 2027.
The model focuses on five key domains: governance, secure-by-design risk management, vulnerability & patch management, product lifecycle management, and cybersecurity skills. It enables organisations to perform a structured self-assessment using 25 maturity questions, scoring from Level 1 (ad hoc) to Level 5 (continuously improved).
Companies are classified into Basic, Intermediate or Advanced maturity profiles, providing a clear view of strengths and improvement areas. The framework emphasizes Security by Design, SBOMs, vulnerability handling, secure default configurations, and continuous product support throughout the lifecycle.
Rather than acting as a compliance certificate, the model helps organisations build repeatable and measurable security practices aligned with CRA expectations. ENISA also provides practical improvement checklists, enabling SMEs to prioritize quick wins and develop long-term cyber resilience roadmaps.
As the Cyber Resilience Act approaches, this maturity model is an excellent starting point for software and hardware manufacturers to assess their readiness and identify gaps before regulatory deadlines arrive.
