Sold by: Porta Regulus B.V.
CVD Portal puts every EU Cyber Resilience Act (CRA) obligation in one place, from product classification to Article 14 vulnerability reporting. It is for US and other manufacturers that sell hardware or software products in the EU. Each manufacturer also gets a free vulnerability disclosure portal.
Overview
The EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) applies to every manufacturer that sells products with digital elements in the EU. The location of the manufacturer does not change this. A US company that sells connected devices or software in the EU has the same manufacturer obligations as an EU company.
The CRA applies in two steps. From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents under Article 14. From 11 December 2027, all other obligations apply. From that date, each product that a manufacturer places on the EU market needs a CRA conformity assessment and CE marking.
CVD Portal puts all of this work in one place. For each product, you classify it as default, important (class I or II) or critical. You do the risk assessment and record evidence for each Annex I essential requirement. The platform drafts the technical documentation and the EU Declaration of Conformity from your data, and your team reviews and approves each draft.
Vulnerability handling starts at the disclosure portal. Each manufacturer gets a portal on its own subdomain or custom domain, where security researchers send reports. Your team acknowledges each report, tracks the 48-hour acknowledgment target, triages it with CVSS scoring and links it to the affected product. When a vulnerability is actively exploited, the platform prepares the early warning, the notification and the final report, with their deadlines. An authorized person at your company submits each stage on the ENISA Single Reporting Platform.
A manufacturer with no establishment in the EU also reports through the ENISA Single Reporting Platform, to the CSIRT of one Member State. The platform finds that Member State from the authorized representative, importer, distributor or user location that you record.
For component risk, you upload an SBOM for each product version. The platform checks the components against public vulnerability data and the CISA Known Exploited Vulnerabilities catalog. You can publish security advisories in CSAF 2.0 format.
EU importers and distributors must check that a manufacturer has done its CRA work before they sell its products. An optional trust portal shares your CRA evidence with them and with your business customers. Teams connect the platform to their ticketing, SIEM and GRC tools through a REST API and webhooks. AI agents connect through an MCP server. SAML single sign-on controls team access.
Consultancies and testing labs can manage CRA work for many client companies from one partner account. The platform is hosted in Germany. The disclosure portal is free. Paid plans add remediation tracking, Article 14 reporting and the compliance workspace. Porta Regulus B.V., a software company in the Netherlands, builds and operates CVD Portal.
Highlights
- Reporting duties apply from 11 September 2026. The platform prepares each Article 14 report and finds the correct EU CSIRT for a manufacturer with no EU establishment.
- One record per product holds the classification, risk assessment, Annex I evidence, technical documentation and EU Declaration of Conformity. You need these for CE marking from 11 December 2027.
- An optional trust portal shares your CRA evidence with EU importers, distributors and customers. A REST API, webhooks and an MCP server connect your tools and AI agents.
Details
Sold by
Categories
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
Enterprise | Enterprise plan, every CRA module, 25 products | $20,700.00 |
Dimensions summary
This listing offers one Enterprise plan billed as a contract. You get every CRA compliance module in a single package, with no separate tiers to combine. Pricing covers lifecycle support for 25 products through the guided self-assessment workspace, from classification and risk assessment to the EU Declaration of Conformity. Vulnerability disclosure intake stays unlimited regardless of product count. If you take more than 25 products through the full workspace, each extra product carries a monthly per-product fee. The plan sets a fixed scope, so pricing scales mainly by products beyond the included 25.
Top-of-mind questions for buyers
A product counts when you take it through the guided self-assessment workspace. Each product goes through classification, risk assessment, and its EU Declaration of Conformity. Vulnerability disclosure intake stays unlimited and does not count against the 25. Products using a third-party route use the same workspace to prepare their technical file.
Each product beyond the included 25 carries a monthly per-product fee. The base plan covers 25 products for the full lifecycle workflow. Extra products are billed individually per month, so cost scales with how many additional products you run through the guided self-assessment.
The plan prepares the technical documentation and risk assessment to submit to your assessment body. It does not replace the third-party auditor. Default-class products can complete the whole workflow within the platform. Class I, Class II, and critical products still need a notified body or certification scheme.
cvdportal.com+1
Helpful?
Vendor refund policy
No refunds after the contract starts, except where the law requires one. We correct billing errors. Email support@cvdportal.com .
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
Email support@cvdportal.com for product and account questions. Guides for each CRA workflow are at
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Deloitte’s CRA Scope & Applicability Check provides a structured approach to identify which of the client’s products within the portfolio are in scope of the CRA and which role or roles the organization assumes in context of CRA. Therefore, the service helps establish transparency on whether affected products need to rely on relevant AWS-supported digital services as part of further CRA-compliance measures.
Deloitte’s CRA Enablement & Transformation Advisory helps organizations translate regulatory requirements into sustainable operating capabilities. The service supports the design and implementation of governance, processes, methods, and execution roadmaps required to embed CRA-related requirements into day-to-day operations.
Deloitte’s CRA Readiness Assessment provides a structured view of an organization’s current level of maturity in relation to the Cyber Resilience Act compliance. This involves analyzing the organizational setup, processes, methods, and tools. In the tool context, the use of AWS services is also examined, and highlights what services are needed to be CRA-ready.
The CRA Gap Assessment is a structured engagement designed to prepare your organization for the upcoming Cyber Resilience Act (CRA) requirements. This phase ensures your products and processes meet regulatory obligations while strengthening overall cybersecurity posture by focusing on what matters.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.