SME Cyber Resilience Act Survey

Back to main topic

Content

In order to ensure appropriate support, understanding the perspective of SMEs is essential to make sure that guidelines being made are practical and usable for them.

Checklist and clipboard task management, online survey form completion

Micro, small and medium enterprises (SMEs) make up the majority of manufacturers, distributors or importers of digital products with digital elements in Europe. Manufacturers, large and small, also rely on SMEs as their suppliers. With the Cyber Resilience Act (Regulation (EU) 2024/2487) entering into application in December 2027, manufacturers of products with digital elements, including SMEs, will need to ensure the cybersecurity of their products. The European Commission and ENISA aim to support the implementation of the CRA by SMEs.

Background on the Cyber Resilience Act

The Cyber Resilience Act (CRA) is a new EU regulation that introduces cybersecurity requirements for all products with digital elements placed on the EU market. Its aim is to ensure that software and hardware are designed securely, include proper vulnerability management and receive necessary security updates throughout their lifecycle. The CRA affects manufacturers, developers and suppliers of software and hardware products of all sizes, including SMEs.

ENISA, supports the European Commission and Member States in strengthening cybersecurity across Europe. As part of the Commission’s SME Strategy on cybersecurity, ENISA provides practical guidance, tools and expertise to help smaller companies understand and meet new cybersecurity requirements, including those introduced by the CRA.

For more information, please visit the Commission’s website on the CRA implementation at: Cyber Resilience Act - Implementation | Shaping Europe’s digital future

On that basis, ENISA is launching a survey for SMEs on the Cyber Resilience Act (CRA) with the aim to understand:

  • Their overall level of CRA awareness, how ready and mature they feel for it, and what kind of support they would find most useful

The results will provide input to ENISA and the European Commission on measures to best support SMEs in their implementation efforts, give an indication of SME readiness for the CRA, and help plan targeted support actions, including awareness campaigns, training materials, and dedicated guidance. It would also support evidence-based input into national and EU-level discussions on CRA implementation.

We therefore invite all interested SMEs to share their views.