ENISA Secure by Design CRA Compliance Scorecard: SaaS Developer Self-Assessment 2026

Post #5/5 in the sota.io EU ENISA Secure by Design Series

This is the finale of the EU-ENISA-SECURE-BY-DESIGN-2026 series. Across four posts we covered the ENISA Secure by Design Playbook (CRA Annex I checklist), the Secure by Default hardening guide, the SDLC compliance framework, and the CVD programme guide.

Now we put it all together: a complete CRA self-assessment scorecard you can run in an afternoon. Print it, fill it out, hand it to your legal team or a notified body auditor. If you score GREEN in all seven domains, your SaaS product is audit-ready for CRA entry-into-application (August 2025 for critical categories, progressively until December 2027 for others).

Why a Scorecard?

CRA compliance is not binary. Products land on a spectrum from "informally secure" to "formally certified". The ENISA Secure by Design Playbook (v0.4, April 2026) defines 22 security properties across five categories. CRA Articles 12–14 add mandatory lifecycle, hardening, and CVD obligations. Annex I enumerates 15 essential requirements.

The problem: no single document maps all of these to concrete developer actions with a Go/No-Go verdict. This scorecard fills that gap. Seven domains, 60 checks, three outcomes per check: GREEN (compliant), AMBER (partial — remediation plan required), RED (non-compliant — must fix before CE marking).

How to Use This Scorecard

Time required: 2–4 hours for a team of 3 (product owner, lead engineer, security lead).

Scoring:

• GREEN = documented evidence exists, control is operational
• AMBER = control exists but documentation incomplete, or control partial
• RED = control missing or non-operational

Thresholds for CE marking readiness:

• All RED items resolved → mandatory
• AMBER items: remediation plan with timeline → acceptable for Type I (self-declaration)
• For critical products (Annex III/IV): external audit even if all GREEN

Domain 1: Secure Design & Architecture (CRA Annex I §1–4)

Covers threat modelling, attack surface reduction, principle of least privilege, and security-by-design documentation.

Domain 1 Score: ___/8 GREEN, ___/8 AMBER, ___/8 RED

Domain 2: Secure Development Lifecycle (CRA Art.13 + ENISA SDLC)

Covers secure coding standards, SAST/DAST integration, dependency management, and developer training.

Domain 2 Score: ___/10 GREEN, ___/10 AMBER, ___/10 RED

Domain 3: Secure by Default Configuration (CRA Art.12(2) + ENISA Hardening)

Covers default-off attack surface, credential hygiene, network hardening, and configuration validation.

Domain 3 Score: ___/10 GREEN, ___/10 AMBER, ___/10 RED

Domain 4: Vulnerability Handling & CVD Programme (CRA Art.14 + ENISA CVD Guide)

Covers disclosure policy, internal handling process, patching SLAs, and customer notification.

Domain 4 Score: ___/10 GREEN, ___/10 AMBER, ___/10 RED

Domain 5: Security Maintenance & Updates (CRA Annex I §10–12)

Covers patch delivery, EOL policy, update integrity, and long-term maintainability.

Domain 5 Score: ___/8 GREEN, ___/8 AMBER, ___/8 RED

Domain 6: Incident Response & Recovery (CRA Annex I §13–15)

Covers incident detection, containment, recovery, and post-mortem processes.

Domain 6 Score: ___/7 GREEN, ___/7 AMBER, ___/7 RED

Domain 7: Documentation & Conformity (CRA Annex I + Conformity Assessment)

Covers technical documentation, Declaration of Conformity, and CE marking readiness.

Domain 7 Score: ___/7 GREEN, ___/7 AMBER, ___/7 RED

Overall Scorecard Summary

CRA Readiness Bands

🟢 CE-Ready (50–60 GREEN, 0 RED) You have documented, operational controls across all domains. For Type I products (self-declaration), prepare your Declaration of Conformity and technical file. For Annex III products, engage a notified body with this scorecard as the pre-audit evidence package.

🟡 Remediation Required (35–49 GREEN, 0 RED) You have a solid foundation but documentation gaps or partial controls remain. Focus AMBER items into a 60-day remediation sprint. Prioritise Domains 4 (CVD) and 3 (Secure by Default) — these are the most frequently cited gaps in ENISA audit guidance.

🔴 Foundation Work Needed (<35 GREEN or any RED) You need structured remediation before attempting CE marking. Start with Domain 3 (quick wins: security headers, TLS, no default passwords) and Domain 4 (CVD: security.txt + intake process). These two domains together have 20 checks and can typically be brought to GREEN in 2–4 weeks.

60-Day CRA Readiness Sprint

For teams in the 🔴 or 🟡 bands, this sprint sequence delivers the highest impact per week:

Weeks 1–2: Quick Wins (Domains 3 + 4)

• Enable security headers (1 day)
• Add security.txt (2 hours)
• Create security report intake alias (1 day)
• Document patching SLA (half day)
• Enable SAST in CI pipeline (2 days)

Weeks 3–4: Process Documentation (Domains 2 + 6)

• Write secure coding standards (3 days)
• Document incident response plan (2 days)
• Configure centralised logging (3 days)
• Set up backup testing schedule (1 day)

Weeks 5–6: Architecture & Lifecycle (Domains 1 + 5)

• Conduct threat modelling workshop (2 days)
• Generate SBOM for current release (1 day)
• Write EOL policy (1 day)
• Audit dependencies for EOL libraries (1 day)

Weeks 7–8: Documentation & Conformity (Domain 7)

• Draft technical documentation outline
• Identify notified body (if Annex III)
• Draft Declaration of Conformity
• Final scorecard re-run → target all GREEN/AMBER

CRA Transition Timeline

Understanding when your obligations kick in prevents last-minute scramble:

Key insight for SaaS: If your software is embedded in hardware products, or if you provide software components to hardware manufacturers, you may be in scope from March 2027. Cloud services that are purely subscription-based (SaaS-only delivery) fall under NIS2 incident reporting obligations but are currently outside CRA's direct scope — however, components you ship as downloadable agents, CLI tools, or SDKs are in scope.

The ENISA Secure by Design Series: What We Covered

This series translated five ENISA guidance documents into actionable developer checklists:

1. Playbook & Annex I Checklist — 22 ENISA security properties mapped to 49 CRA Annex I checks. The foundation.

2. Secure by Default Hardening Guide — CRA Art.12(2) operationalised: configuration management, credentials, network hardening, and the three-layer default security model.

3. SDLC Compliance Framework — CRA Art.13 as a living lifecycle obligation: SAST/DAST/SCA integration, SBOM generation, developer training cadences, and the 90-day compliance calendar.

4. CVD Programme Guide — CRA Art.14 in practice: VDP launch in 14 days, EUVD coordination, national CSIRT reporting table, and the 24h/72h/5-day cascade.

5. This scorecard — 60 checks across 7 domains. The complete self-assessment instrument.

Deploying on EU Infrastructure

CRA compliance is about your software. But where you run it matters for the surrounding NIS2 and GDPR obligations that intersect with CRA:

• NIS2 Art.21 security measures require "appropriate and proportionate technical measures" — documented controls that map directly to this scorecard.
• GDPR Art.25 data protection by design is satisfied by Domains 1, 3, and 6 of this scorecard.
• CLOUD Act exposure is eliminated when you run on EU-native infrastructure (Hetzner, Scaleway, OVHcloud) with no US-parent data processor in the chain.

sota.io is an EU-native managed PaaS — GDPR-100%, no US parent, no CLOUD Act exposure — that lets you deploy any language on Hetzner Germany. The platform handles the infrastructure layer of your CRA compliance story; this scorecard handles the software layer.

Summary

The CRA Compliance Scorecard gives you a structured, evidence-based picture of where your SaaS product stands before an audit. Sixty checks, seven domains, three traffic lights. Fill it out quarterly. Treat AMBER items as sprint tickets. Resolve all RED items before CE marking.

CRA is not a one-time certification exercise — it is an ongoing secure development culture. The ENISA Secure by Design Playbook makes that culture explicit. This scorecard makes it measurable.

Your next step: download this scorecard, assign domains to your engineering team, and schedule a 2-hour assessment session before July 2026.