What does the SuperClue Cyber Resilience Act scan check?
The CRA scan runs 7 modules of external checks on your product's website and public interfaces, mapped to the essential requirements in Annex I of the EU Cyber Resilience Act. It covers what an outside scan can see, such as transport security, exposed defaults, a vulnerability reporting contact and a published SBOM. It is not a conformity assessment or a certification.
What is EU Cyber Resilience Act?
| Fact | Detail |
|---|---|
| Law | Regulation (EU) 2024/2847 (Cyber Resilience Act), in force since 10 December 2024 |
| Reporting | From 11 September 2026: actively exploited vulnerabilities and severe incidents get an early warning within 24 hours and a notification within 72 hours (Article 14) |
| Full application | 11 December 2027 |
Who does EU Cyber Resilience Act apply to?
- Manufacturers of hardware and software products with digital elements sold in the EU.
- Importers and distributors of those products.
- Products covered by their own sector rules, such as medical devices, are excluded.
What does the EU Cyber Resilience Act scan check?
The scan runs 7 modules against the URL you give it. Each module maps what it can see from outside to one area of the framework.
| Module | What it looks at from outside |
|---|---|
| No Known Exploitable Vulnerabilities | Security headers, version disclosure and error leaks. Run a full scan or Nuclei for CVEs. |
| Secure by Default | Exposed default files, admin paths and configuration. |
| Protection from Unauthorised Access | Finds login and API endpoints and checks cookie flags. |
| Confidentiality in Transit | TLS version, certificate and transport headers. |
| Limited Attack Surface | Exposed health and status endpoints and cross-origin rules. |
| Vulnerability Disclosure | security.txt with a contact, a policy link and a current expiry date. |
| Software Bill of Materials | A CycloneDX or SPDX SBOM at common public paths. |
What can the scan not see?
Data minimisation, integrity of internal processing, logging, the update mechanism, internal security testing and your reporting process are internal. The scan notes what evidence you need for these.
A passed check means the public signal is in place, not that the control works. Modules that need internal records can finish as "requires access". The scan is not an audit or a certification, and SuperClue is not a regulator or auditor.
What are the penalties?
| Failure | Maximum penalty | Source |
|---|---|---|
| Breaching the Annex I essential requirements or the Article 13 and 14 obligations | Up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher | CRA Article 64(2) |
| Breaching other listed obligations (for example importers, distributors and notified bodies) | Up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher | CRA Article 64(3) |
| Giving incorrect, incomplete or misleading information to notified bodies or market surveillance authorities | Up to EUR 5 million or 1% of total worldwide annual turnover, whichever is higher | CRA Article 64(4) |
What does it cost?
The default rate is 0.30 credits per module, so all 7 modules come to 2.1 credits. See pricing or compare all 14 framework scans.
Run the 7 EU Cyber Resilience Act checks on a domain you have verified.
Request access