The model scores an organisation across five domains - governance and documentation, risk management, vulnerability management, product lifecycle management and cybersecurity skills - using a downloadable, self-scoring Excel questionnaire that can be reused over time to track progress. ENISA is explicit that a higher maturity score does not replace formal CRA compliance; it is a diagnostic tool, not a conformity assessment.

It is aimed mainly at companies that manufacture or place products with digital elements on the EU market, which includes a growing number of retailers acting as importers or distributors of connected products.

#CyberResilienceAct #DigitalSMEs #RetailSMEs #DigitalRetail