Skip to content

Cyber Resilience Act · Risk assessment · Technical documentation

Risk assessment your auditor can follow.

Atrekos computes a product cybersecurity risk assessment and keeps the facts, measures and treatment decisions behind each result traceable.

Built for product-security and engineering teams at manufacturers of connected industrial and embedded products.

Discuss an assessment pilotInspect the sample report ↓

The assessment supports your technical documentation. It does not establish conformity.

What you get

See what your assessment produces.

Keep your assessment as PDF reports, JSON data and an XLSX workbook for review. These outputs contribute to your technical documentation; they do not form the complete technical file.

Deliverables

Assessment report

PDF

Risks, measures, conditions and treatment decisions for review.

Result summary

PDF

The computed results and priority findings.

Assessment data

JSON

Structured assessment data in the documented export format.

Traceability matrix

XLSX

Exported values for review; this workbook does not recompute the assessment.

Request the sample reportView export formats

Report download pending #753. Example export pending #753.

Assessment report · excerpt

Synthetic demonstration · Industrial Cellular Router

Assessment record
Not recorded
Treatment actions
Not recorded

Implementation is not recorded. Recorded decisions and assessment approval are separate from implementation.

Highest residual risks

13 findings · 1 High · 12 Moderate

FindingResidualTreatment

F1 · R22-39

Attack step AS39

DS5 · Damage scenario DS5 · High

High

Decision: mitigate · Proposal: manual

Owner: Alice · Review by: 2027-01-31

F2 · R1-3

Attack step AS3

DS13 · Damage scenario DS13 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

F3 · R1-3-10

Attack step AS10

DS14 · Damage scenario DS14 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

10 more findings, all Moderate · Decision: mitigate · Owner: AliceShow all 13 findingsShow the top 3 only
FindingResidualTreatment

F4 · R1-3-11

Attack step AS11

DS14 · Damage scenario DS14 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

F5 · R1-6

Attack step AS6

DS14 · Damage scenario DS14 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

F6 · R1-7

Attack step AS7

DS13 · Damage scenario DS13 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

F7 · R1-16

Attack step AS16

DS13 · Damage scenario DS13 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

F8 · R1-25

Attack step AS25

DS13 · Damage scenario DS13 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

F9 · R1-29

Attack step AS29

DS13 · Damage scenario DS13 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

F10 · R1-40

Attack step AS40

DS13 · Damage scenario DS13 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

F11 · R22-23

Attack step AS23

DS13 · Damage scenario DS13 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

F12 · R22-24

Attack step AS24

DS5 · Damage scenario DS5 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

F13 · R22-26

Attack step AS26

DS13 · Damage scenario DS13 · High

Moderate

Decision: mitigate · Proposal: accept

Owner: Alice · Review by: 2027-01-31

Initial and residual risk

  • Initial
  • Residual, with assigned measures and conditions

Residual holds only if the assigned measures work and the operating conditions are met. It counts assignments, confirmed or not.

Very High
Initial33
Residual0
High
Initial19
Residual1
Moderate
Initial9
Residual33
Low
Initial0
Residual20
Negligible
Initial0
Residual7

Risks, initial and residual: 61 · 61

Counts of risks on one scale, not probabilities or a percentage improvement in security.

View as a table
Initial and residual risk
LevelInitialResidual
Very High330
High191
Moderate933
Low020
Negligible07

Measures and conditions, by who is responsible

Assignment and recorded confirmation are distinct. A confirmation does not establish effectiveness or independent verification.

Comparison based on recorded confirmations; inline and legacy assignment exceptions remain as calculated by the engine. Divergent risks: 17.

If a condition is not met, the ratings that depend on it no longer hold.

23 assigned items by responsible party
Responsible partyAssignedConfirmation recordedHandover recorded
Product measures · party not recorded100–
Manufacturer · conditions500
Operator · conditions610
Integrator · conditions221
Total2331
Show all 23 measures and conditions
Assigned / planned
Assigned and counted in the calculation. Implementation is not recorded.
Not confirmed
No confirmation is recorded for this item.
Confirmation recorded
A confirmation is recorded; it does not establish effectiveness or independent verification. The actor may not be recorded.
Handover recorded
A condition handover is recorded separately from confirmation.

Product measures

  • CM14 · Measure CM14

    Assigned / plannedNot confirmed

    Responsible party: Not recorded · Actor: Not recorded · Implementation: Not recorded

  • CM5 · Measure CM5

    Assigned / plannedNot confirmed

    Responsible party: Not recorded · Actor: Not recorded · Implementation: Not recorded

  • CM12 · Measure CM12

    Assigned / plannedNot confirmed

    Responsible party: Not recorded · Actor: Not recorded · Implementation: Not recorded

  • C3 · Measure C3

    Assigned / plannedNot confirmed

    Responsible party: Not recorded · Actor: Not recorded · Implementation: Not recorded

  • CM16 · Measure CM16

    Assigned / plannedNot confirmed

    Responsible party: Not recorded · Actor: Not recorded · Implementation: Not recorded

  • CM17 · Measure CM17

    Assigned / plannedNot confirmed

    Responsible party: Not recorded · Actor: Not recorded · Implementation: Not recorded

  • C17 · Measure C17

    Assigned / plannedNot confirmed

    Responsible party: Not recorded · Actor: Not recorded · Implementation: Not recorded

  • C21 · Measure C21

    Assigned / plannedNot confirmed

    Responsible party: Not recorded · Actor: Not recorded · Implementation: Not recorded

  • C27 · Measure C27

    Assigned / plannedNot confirmed

    Responsible party: Not recorded · Actor: Not recorded · Implementation: Not recorded

  • C17 · Measure C17

    Assigned / plannedNot confirmed

    Responsible party: Not recorded · Actor: Not recorded · Implementation: Not recorded

Operating conditions others must meet

  • A12 · Condition A12

    Assigned / plannedConfirmation recorded

    Responsible party: operator · Actor: Not recorded · Implementation: Not recorded

  • A44 · Condition A44

    Assigned / plannedNot confirmed

    Responsible party: operator · Actor: Not recorded · Implementation: Not recorded

  • A39 · Condition A39

    Assigned / plannedNot confirmed

    Responsible party: manufacturer · Actor: Not recorded · Implementation: Not recorded

  • A45 · Condition A45

    Assigned / plannedNot confirmed

    Responsible party: operator · Actor: Not recorded · Implementation: Not recorded

  • A45 · Condition A45

    Assigned / plannedNot confirmed

    Responsible party: operator · Actor: Not recorded · Implementation: Not recorded

  • A45 · Condition A45

    Assigned / plannedNot confirmed

    Responsible party: operator · Actor: Not recorded · Implementation: Not recorded

  • A16 · Condition A16

    Assigned / plannedConfirmation recorded

    Responsible party: integrator · Actor: Not recorded · Implementation: Not recorded

  • A13 · Condition A13

    Assigned / plannedConfirmation recordedHandover recorded

    Responsible party: integrator · Actor: Not recorded · Implementation: Not recorded

  • A17 · Condition A17

    Assigned / plannedNot confirmed

    Responsible party: manufacturer · Actor: Not recorded · Implementation: Not recorded

  • A18 · Condition A18

    Assigned / plannedNot confirmed

    Responsible party: manufacturer · Actor: Not recorded · Implementation: Not recorded

  • A28 · Condition A28

    Assigned / plannedNot confirmed

    Responsible party: operator · Actor: Not recorded · Implementation: Not recorded

  • A37 · Condition A37

    Assigned / plannedNot confirmed

    Responsible party: manufacturer · Actor: Not recorded · Implementation: Not recorded

  • A37 · Condition A37

    Assigned / plannedNot confirmed

    Responsible party: manufacturer · Actor: Not recorded · Implementation: Not recorded

Synthetic demonstration · Model 1.0 · Engine 0.7.0

Provenance and what this does not show
Product
Industrial Cellular Router
Organisation
ACME Security
Revision
Not recorded
Report date
Not recorded
Generated at
2026-10-08T10:00:00Z
Model
1.0
Engine
0.7.0
Pack revision
1.0
Input hash
7e429d9075904160
Source SHA-256
d78921246ff3e78d080c75ec72d2070ea695abba98b3f88641ee2eed296cd2a7
Artifact SHA-256
ae26b6ad14e79d362a463895b787b489249fb6673fdeaf634c46f7c348724acb

Catalogue versions: questions 1.0 · damageScenarios 1.0 · attackSteps 1.0 · assumptions 1.0 · countermeasures 1.0

Catalogue source:QuBA-libre· CC BY-SA 4.0
View schemas on GitHub

This example does not establish that measures were independently tested or that the product conforms to any regulation.

Want this for your product?

Discuss an assessment pilotFollow one risk through the calculation ↓

The calculation

One risk, from the product facts behind it to the recorded decision.

Recorded product facts, versioned catalogues, model choices and the measures you assign produce damage scenarios, attack paths, attack potential and risk levels. Risk levels follow the assessment's model. Its acceptance rules identify which risks need a recorded decision.

Synthetic demonstration · Industrial Cellular Router

Assignment and recorded confirmation are distinct. A confirmation does not establish effectiveness or independent verification.

R22-39 7 steps · initial High → residual High · decision mitigate

  1. 1 · Originating answer QI2 No · QI4 No · QI5 Yes
    • QI2 · Question QI2: No
    • QI4 · Question QI4: No
    • QI5 · Question QI5: Yes · Major disturbance
  2. 2 · Damage scenario DS5 · damage High
    • DS5 · Damage scenario DS5 · High
  3. 3 · Attack path AS22 → AS39
    1. AS22 · Attack step AS22
    2. AS39 · Attack step AS39
  4. 4 · Initial risk High Attack potential High · sum 24
    High

    Required attack potential: High · Sum: 24

    Damage: High · Matrix: High × High → High

  5. 5 · Measures and conditions Measure C3 · Condition A39 · both not confirmed

    5 · Scored measures and contextual conditions

    Assignments receive calculation credit; credit is not verification of implementation or effectiveness.

    • Measure C3 · Not confirmed

      Contributes to factor scores or damage transformation.

    • Condition A39 · Not confirmed

      Contributes to factor scores or damage transformation.

  6. 6 · Residual risk High unchanged · sum 24
    High

    Required attack potential: High · Sum: 24

    Damage: High · Matrix: High × High → High

  7. 7 · Treatment Decision mitigate · Owner Alice · Review by 2027-01-31
    Engine proposal
    manual
    Recorded decision
    mitigate
    Tolerance
    3
    Rationale
    Not recorded
    Owner
    Alice
    Review by
    2027-01-31
    Next action
    Not recorded
    Implementation
    Not recorded
Show the factor scores
FactorInitial maximumResidual maximumOrigins
ET44AS39
EX66AS39
KT33AS39
WO44AS39
EQ77AS39
Sum2424
ClassHighHigh

Residual contributors: Not recorded

  • AS22: WO 0
  • AS39: ET 4 · EX 6 · KT 3 · WO 4 · EQ 7

Attack potential describes the effort required for an attack. Factor maxima form the sum and class; the model matrix combines the class and damage level. It is not a probability.

The full worked calculation on the method page →

How every risk is calculated

  1. 1 · Record product facts

    Answers activate relevant catalogue scenarios and attack steps.

  2. 2 · Follow each path

    The selected model aggregates factor maxima into required attack potential.

  3. 3 · Read the matrix

    The model combines attack-potential class and damage level into initial risk.

  4. 4 · Apply assignments

    Credited measures change scores or damage; operating conditions may contribute context only. Recorded-confirmation comparisons preserve inline and legacy exceptions.

  5. 5 · Record treatment

    Strictly below tolerance, acceptance may be automatic, subject to supported non-negotiable rules. At equality or above, a treatment decision must be recorded. A proposal is separate from that decision and its implementation.

How the calculation works →

The challenge

The CRA does not ask for a checklist. It asks for a risk assessment you can defend.

An assessor, or your customer's product-security team, will ask the same first question of every risk: why this level, and which fact about the product produced it? Keeping product facts, evidence and treatment decisions connected becomes harder as products and reviewers change. Atrekos keeps the assessment record together. Five things make the assessment harder than it sounds.

It has to be a real risk assessment

Art. 13(2) · Annex I Part I

Article 13(2) asks you to assess the cybersecurity risks and to take the outcome into account in how the product is designed, built and maintained. Working through the Annex I requirements is not that. You need threats, damage, likelihood and a defensible risk level for each.

Where Atrekos helps

Atrekos derives damage scenarios and attack paths from your answers and computes each risk from a required-attack-potential model. The level is calculated, not chosen.

It has to be traceable

Art. 13(3) · Annex VII

The assessment goes into the technical documentation, and a conformity assessment reads it line by line. Keep the product facts, catalogue choices, measures and treatment decisions connected so a reviewer can follow the reasoning later.

Where Atrekos helps

Reports connect computed risks to recorded product facts, catalogue and model choices, assigned measures and treatment decisions.

It has to stay current, across the whole portfolio

Art. 13(3) · Art. 13(8)

Keep the assessment current throughout the product's support period. New variants, newly reported vulnerabilities and new standards all change it. Each variant needs a review of what carries over and what has changed.

Where Atrekos helps

Clone the assessment, review what carries over, change what changed, and compare the results. The same pinned input gives the same computed result.

It has to speak the standards' language while they are still being written

Art. 27 · M/606

Draft standards and assessment mappings do not themselves confer a presumption of conformity. Mapping an assessment to standards by hand is work you will redo.

Where Atrekos helps

Atrekos treats the mapping as versioned data: CRA Annex I and ISA/IEC 62443-4-2 today, the horizontal and vertical harmonised standards as they land.

It has to hold at your customer's site

Art. 13(5) · Annex II

Some measures are only true if the integrator, operator or end user does their part. Your customers will ask which, and their own assessment depends on the answer.

Where Atrekos helps

Every condition the assessment relies on is named, with who has to fulfil it.

Assessment modules

One assessment. Three ways it gets used.

The same computed, traceable assessment serves the team that runs it, the outside party that reviews it, and the technical documentation it ends up in.

Self-assessment

Who
Your product, engineering and compliance team.
What
Answer the questionnaire, review the computed risks, decide how each one is treated and record why. Re-run it when the product changes.
Output
The risk assessment for your technical documentation, on the default conformity route.

Art. 32(1) · Annex VIII Module A

Third-party assessment

Who
A consultant, test house or notified body reviewing your product, or an assessor running the assessment on your behalf.
What
They work in your workspace with the role you give them, see the same evidence chain, and confirm which mitigations they accept. The comparison uses recorded confirmations, with inline and legacy assignment exceptions; confirmation is not independent verification.
Output
A reviewed assessment, the comparison based on recorded confirmations, and the package the reviewer takes away.

Art. 32(2)–(3) · Annex VIII Modules B+C, H

Compliance

Who
Whoever owns the technical documentation: product compliance, or the GRC function where it carries the CRA.
What
The assessment is projected onto the requirements: CRA Annex I Part I and Part II, Annex II user information and ISA/IEC 62443-4-2. Coverage and gaps per requirement, with the measures that implement it.
Output
A verdict per requirement with the evidence attached, as the reports and exports that go into the file.

Annex I · Annex II · Annex VII

Lifecycle

The CRA applies across a product's life, not once at CE marking.

Duties start before development and run to the end of support. Each stage carries the article or annex that binds there, and what Atrekos does at that stage. Where the work happens outside it, the stage says so.

Product lifecycle: reassessment and notification as separate paths from MaintainEight stages in order: Plan, Assess, Design, Build, Test, Release, Maintain, Retire. Maintain is the long stage, the support period. During Maintain, a relevant change or a new finding returns to Assess for reassessment, and the change flows forward again. Separately, an actively exploited vulnerability or a severe incident must also be notified under Article 14, outside the tool.
  1. Planpartly
  2. Assessyes
  3. Designpartly
  4. Buildno
  5. Testpartly
  6. Releasepartly
  7. Maintainpartly
  8. Retireno

Where Atrekos does the work at each stage: yes, partly or no. Build and Retire happen outside the tool.

Keep the assessment current throughout the product's support period. A relevant change or a new finding returns to the assessment.

Actively exploited vulnerabilities and severe incidents must also be notified under Article 14. Other findings still require appropriate vulnerability handling and may require upstream disclosure. Reassessment forms part of that response.

Stage obligations and what Atrekos does

  1. Planpartly

    Art. 7–8 · Annex III–IV (class) · Art. 13(8) (support)

    Suggests a class from the product you describe. The decision stays yours.

  2. Assessyes

    Art. 13(2) · Annex I Part I

    Derives damage scenarios and attack paths from your answers and computes each risk level.

  3. Designpartly

    Annex I Part I

    Matches countermeasures and records each treatment decision and why. The architecture is your engineers'.

  4. Buildno

    Annex I Part I

    Code, builds and dependencies are outside the tool.

  5. Testpartly

    Annex I Part I

    Tracks recorded confirmations, and compares the assigned-measures result with the comparison based on them.

  6. Releasepartly

    Annex VII · Annex II · Art. 32 (conformity) · Art. 30 (CE marking)

    Produces the risk assessment and its projections for the file, not the whole file.

  7. Maintainpartly

    Annex I Part II · Art. 14

    Re-runs the assessment and shows the diff when something changes. Monitoring and reporting happen outside it.

  8. Retireno

    Annex I Part I (2)(m)

    Decommissioning, key and credential revocation and end-of-life notices happen outside the tool.

What re-opens an assessment
The product changes
a new interface, a change to the authentication model, new sensitive data, a change to the update mechanism, a major architecture change, a new variant.
The supply chain changes
a supplier or dependency change.
Something happens in the field
an incident, a newly disclosed vulnerability.
The standards move
a newly cited harmonised standard.

Guidance, not obligation. Eight of the ten triggers above are the playbook's. Following it does not establish conformity with the CRA.

ENISA, Secure by Design and Default Playbook v1.0, July 2026

The CRA calendar and what matters now →

A vulnerability found in a fielded product re-enters the risk assessment rather than terminating in a report.

Inspect an example, then talk about your product.

Discuss an assessment pilot for one of your products. We will review its scope, the product inputs needed, the assessment outputs and how your reviewer can follow the reasoning. Atrekos is a closed pilot with selected manufacturers.

Discuss an assessment pilot
Request the sample reportView export formats

Report download pending #753. Example export pending #753.

View the worked calculation

Get early access

Atrekos is running as a closed pilot with selected manufacturers. Join the waitlist with your work address and, if you like, your company, and we will contact you when the next cohort opens.

The operator named in the imprint collects your address to write to you when a place opens. It also notes the link you arrived by and the site you came from, to learn which channels work. Withdraw at any time by replying to any mail from us.

ImprintHow we handle personal data

Atrekos uses only its own, technically necessary cookies to operate.

Cookie policyPrivacy policy