Is this a security audit?

No. It is an indicative self-assessment based on your answers. It does not scan or connect to any device, and it is not a conformity assessment or legal advice.

Teams that design and manufacture connected devices: CTOs, engineering leads and firmware engineers who need a quick view of the security gaps that matter most in their product.

What happens with my answers?

They are processed in your browser and are not sent anywhere, unless you choose to attach a summary to a contact request.

Does a good result mean my product complies with the CRA?

No. The quick assessment covers a subset of controls. Conformity with the Cyber Resilience Act or the Radio Equipment Directive requires a full assessment against the requirements that apply to your product.

Quick assessment

IoT Product Security Check

A quick assessment for teams that build connected devices. Answer up to 16 questions about your product and get the gaps that matter most, with the standards behind each one.

> About 5 minutes
> Your answers are processed in your browser and are only sent if you choose to attach them to a contact request. Progress is kept in this browser until you choose Start over.

This is an indicative self-assessment. It is not a scanner, an audit, a conformity assessment or legal advice, and it does not connect to any device. Results depend solely on your answers.

Not intended for products governed by sector-specific frameworks such as medical devices, motor vehicles, civil aviation or marine equipment.

What this check covers

Ten controls that most often decide whether a connected product can be compromised at scale, plus up to three that depend on your product profile.

A2SBOM for every releaseSecure development
B1No universal default credentialsAuthentication and access
B2No secrets shared between unitsAuthentication and access
B3Authenticated and authorized management functionsAuthentication and access
C1Signed updates with an authorized-version policySoftware integrity
C3Signing key custodySoftware integrity
D1Fixes reach installed unitsUpdates
E1Encrypted and authenticated communicationsCommunications and data
F1Debug interfaces locked in productionAttack surface and limits
F4Operating limits enforced on the device (depends on your product profile)Attack surface and limits
G1Published vulnerability disclosure policyVulnerability handling
G3CRA Article 14 reporting procedure (depends on your product profile)Vulnerability handling
H1RED cybersecurity requirements assessed (depends on your product profile)Regulatory conformity

Standards and regulations behind each question

EU Cyber Resilience Act (Regulation (EU) 2024/2847): Cybersecurity requirements for products with digital elements on the EU market. Reporting obligations apply since 11 September 2026; the regulation applies in full from 11 December 2027.
Radio Equipment Directive: Delegated Regulation (EU) 2022/30 and EN 18031: Cybersecurity requirements for radio equipment placed on the EU market, mandatory since 1 August 2025.
ETSI EN 303 645: Baseline security provisions for consumer IoT devices.
IEC 62443-4-1 and IEC 62443-4-2: Secure development lifecycle and technical security requirements for industrial automation components.
UK PSTI: Security requirements for consumer connectable products sold in the United Kingdom, in force since 29 April 2024.
NIST SP 800-218, NIST IR 8259A and OWASP IoT Top 10: Secure software development practices, baseline device capabilities and common IoT risks.

Frequently asked questions

Is this a security audit?: No. It is an indicative self-assessment based on your answers. It does not scan or connect to any device, and it is not a conformity assessment or legal advice.
Who is it for?: Teams that design and manufacture connected devices: CTOs, engineering leads and firmware engineers who need a quick view of the security gaps that matter most in their product.
What happens with my answers?: They are processed in your browser and are not sent anywhere, unless you choose to attach a summary to a contact request.
Does a good result mean my product complies with the CRA?: No. The quick assessment covers a subset of controls. Conformity with the Cyber Resilience Act or the Radio Equipment Directive requires a full assessment against the requirements that apply to your product.