A NAS device is one of the most cybersecurity-exposed consumer and SMB products on the market. It runs a full operating system, exposes network services (SMB, NFS, HTTP, FTP, SSH), processes sensitive data and is frequently internet-accessible. Public ransomware campaigns (Deadbolt, QLocker, eCh0raix) have demonstrated that NAS devices are systematically targeted. Regulation (EU) 2024/2847 addresses exactly this risk class. Annex VII documentation must cover vulnerability handling processes, SBOM, secure default configuration and cybersecurity risk assessment. CRACheck generates 8 PDF documents. 15-25 minutes. €149 per NAS model. Browser-side.
€149 one-time · 8-document ZIP · 15-25 minutes · Browser-side
NAS devices are ransomware targets with documented CVEs. CRA documentation is not optional — it is a competitive necessity.
NAS devices are ransomware targets with documented CVEs. CRA documentation is not optional — it is a competitive necessity.
Annex I Part I point 1(d) requires secure by default configuration. If the NAS is accessible on the network with default credentials before the user completes the setup wizard, it is vulnerable during that window. Best practice under CRA: unique device-specific credentials out of the box, or mandatory credential setup before any network service is enabled.
Article 14 requires active notification to ENISA and the designated CSIRT within 24 hours of becoming aware of an actively exploited vulnerability. Publishing an advisory on your website is a disclosure action. ENISA notification is a separate legal obligation with a specific timeline and reporting platform. Both are required.
Annex VII point 2(b) requires the SBOM as part of vulnerability handling documentation. A NAS running Linux with hundreds of packages has a large SBOM — this is expected. Use automated SBOM generation tools (Syft, Trivy) to extract the component list. CRACheck structures the output into Annex VII format. The SBOM size reflects your product's complexity — it is not a reason to skip it.
NAS devices are complex digital products with large attack surfaces. CRACheck generates 8 documents covering every CRA-relevant dimension.
Determines product category per Annex III. Defines conformity assessment route under Art. 32.
Complete technical documentation structured per Art. 31 and Annex VII. All 8 mandatory sections.
Cybersecurity risk assessment per Art. 13.2 and Art. 13.3. Mapped against Annex I Part I requirements.
Information and instructions per Annex II. Security properties, support period, vulnerability reporting.
EU declaration of conformity per Art. 28 and Annex V.
Coordinated Vulnerability Disclosure policy per Annex I Part II.
Pre-structured for 24h early warning, 72h notification, 14-day final report under Art. 14.
Key dates: Art. 14 from 11 Sep 2026, full enforcement 11 Dec 2027, support period per Art. 13.8.
Mira antes de comprar — Descargar dossier de muestra (PDF, empresa ficticia) — Estructura real, artículos reales, formato real. Datos ficticios.
Generated in your browser. No product data is transmitted to any server.
Generates Annex VII documentation for your NAS. Covers network services, firmware, SBOM, vulnerability handling, secure defaults and risk assessment.
CRACheck does not perform penetration testing, vulnerability scanning or ransomware resilience assessment. Your NAS needs both documentation and security testing. CRACheck handles the documentation.
We document. You pentest.
Article 64 establishes three tiers of administrative fines. Penalties are calculated per undertaking — but non-compliance on a single product can trigger inspection of your entire portfolio.
Art. 64.2. Up to €15 million or 2.5% of total worldwide annual turnover, whichever is higher.
Art. 64.3. Up to €10 million or 2% of total worldwide annual turnover, whichever is higher. Includes failure to produce Annex VII documentation.
Art. 64.4. Up to €5 million or 1% of total worldwide annual turnover, whichever is higher.
Art. 64.5 accounts for the nature, gravity and duration of the infringement, and gives consideration to microenterprises, small and medium-sized enterprises, including start-ups.
| Alternative | Cost | What you get |
|---|---|---|
| Cybersecurity audit + documentation | €20,000–€40,000 | Per NAS platform. 4-8 months. |
| Publish CVE responses only | €0 | CVE response is one component. Annex VII requires complete documentation. |
| Rely on community trust (open-source NAS OS) | €0 | Community trust does not satisfy Art. 31. Documented compliance required. |
| CRACheck | €149 | 8 docs. 15 min. Per NAS model. |
Each NAS model with different firmware or hardware platform needs its own CRA dossier. 2-bay consumer, 4-bay SMB, 12-bay rack — three products, three dossiers. Volume pricing: €99/product (10-pack), €79/product (30-pack).
Request volume pricingCRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, completeness and truthfulness of that information is your responsibility as the manufacturer.
We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct as of the last verification date. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case or by a commercial buyer in a procurement process.
CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.