CRA Scope Assessment Tool — Promotional Post Outlines

Is your product subject to the EU Cyber Resilience Act?

The CRA (Regulation EU 2024/2847) applies to virtually all products with digital elements sold in the EU — with full compliance required by 11 December 2027 and reporting obligations starting 11 September 2026.

We built a free, privacy-first assessment tool that tells you in under 5 minutes:

• Whether your product is in scope
• Your classification (Default, Important, Critical)
• Which conformity path applies
• Your obligations based on your role in the supply chain

No registration. No data collection. Works offline.

Try it now: cra.asphaliaconsulting.be

NIS2 2026 Amendments

If you've just finished mapping your NIS2 obligations, you might not want to hear this — but the directive was explicitly designed to evolve, and the first major review cycle is already approaching in 2026.

Understanding what the European Commission will be evaluating, from sector coverage to cross-border coordination mechanisms, can help you build a compliance programme that won't need a complete overhaul when the amendments arrive. Here's a breakdown of what to watch for.

Use Case 1

NIS2 Compliance: Know Your Attack Surface

The Challenge

Since October 2024, NIS2 requires essential and important entities to "take appropriate and proportionate technical, operational and organizational measures to manage the risks posed to the security of network and information systems" (Article 21). This explicitly includes vulnerability management and knowledge of your exposed assets.

For many SMEs, this represents a significant challenge: how do you identify what attackers can see of your infrastructure without an in-house security team or expensive enterprise tools?

Our Solution

Asphalia Analytics provides a complete inventory of your external attack surface with risk prioritization aligned to NIS2 requirements:

• Asset Discovery: Identification of all your exposed assets (domains, subdomains, IPs, services)
• Shadow IT Detection: Uncovering forgotten or unknown assets that could be exploited
• Vulnerability Assessment: Detection of exploitable vulnerabilities on exposed services
• Compliance-Ready Reporting: Report directly usable for your compliance audits
• Prioritized Remediation: Actionable recommendations ranked by risk level

Expected Outcome

Documentation ready to demonstrate your compliance with Article 21.2 (vulnerability management) during regulatory inspections or audits.

Use Case 3

M&A Due Diligence: Evaluate the Cyber Risk of Your Target

The Challenge

During an acquisition, the target's cyber risk becomes your risk. Undiscovered vulnerabilities, shadow IT assets, and poor security practices can represent significant hidden costs post-acquisition. Traditional due diligence often overlooks cyber exposure, leaving acquirers with unexpected remediation costs and potential liability.

The challenge is compounded by the need to assess security posture without alerting the target or requiring access to their internal systems during early-stage negotiations.

Our Solution

Without any access to the target's systems (100% external and non-invasive assessment), we provide:

• Complete Attack Surface Inventory: Full mapping of the target's external footprint
• Critical Risk Identification: Exposed services, known vulnerabilities, misconfigurations
• Data Leak Detection: Discovery of existing credential leaks, exposed documents, or sensitive data
• Comparative Security Score: Benchmarking against industry standards and peers
• Historical Analysis: Changes in security posture over time where data is available

Expected Outcome

A cyber due diligence report enabling informed negotiation and post-acquisition remediation planning. Identify potential deal-breakers or negotiate price adjustments based on discovered security debt.

5.01 - Policies for Information Security - OnePager