What you get, step by step.

What you give us: the product, its cybersecurity risk assessment and technical documentation if they exist, the software bill of materials if you have one, and your own view of the product's scope, your role and its class, which we take as our starting point.

What you get:

• our observations against each essential requirement in Annex I, in three columns: the requirement, what we observed, and what your documentation does not show;
• a review of your cybersecurity risk assessment;
• what your technical documentation does not yet contain of the content listed in Annex VII;
• observations on your support period and on how you would handle and report a vulnerability;
• the results of automated vulnerability discovery on the product;
• a prioritised list of actions before December 2027, and an executive summary;
• a call to walk you through it.

What you give us: one product and version with no documentation yet, access to its build, working sessions with your engineer, and a one-page cover sheet stating, in your words, your view of the product's scope, your role, its class and the conformity route, which we carry as your assumptions.

What you get:

• a software bill of materials generated from your build;
• a cybersecurity risk assessment and threat model, written from your product and the working sessions;
• the Annex I table: each essential requirement, what is implemented, and what is not yet shown;
• your vulnerability-handling process: the contact point, the disclosure policy, the update process, and the Article 14 playbook with the early-warning, notification and final-report templates, with one drill for your team;
• the technical documentation assembled to the structure of Annex VII, with its index, for your review and signature.

What you give us: written authorisation and an agreed scope.

What you get:

• hands-on attack testing of the product, its firmware, its APIs and the back-end systems you operate for it;
• every finding verified by hand, with the steps to reproduce it, and recorded against the Annex I requirement it concerns, for the version tested;
• a report written to sit with the test reports in your technical documentation (Annex VII, point 6);
• a retest to check whether your fixes hold.

What you give us: a written mandate.

What you get:

• your vulnerability inbox run for you, and your software bill of materials watched for newly published vulnerabilities;
• a quick technical read of the evidence of exploitation; whether it is an actively exploited vulnerability under Article 3, point (42), is your decision;
• the early warning and the notification without undue delay (at the latest within 24 and 72 hours), and the final report, prepared for your sign-off (Article 14);
• fixes checked, records kept, and your risk assessment updated after significant vulnerabilities, for your approval;
• a drill once a year.