Frequently asked questions

It guides you through a Cyber Resilience Act threat & risk analysis and maps CRA, NIS 2 and IEC 62443 requirements onto your secure development process, then exports the documentation you need to keep.

No — and that's deliberate. GRC suites manage your organisation's controls and policies across many frameworks (ISMS, ISO 27001, business continuity, supplier risk). TRA Studio works one level down: it produces the product-level evidence the CRA actually requires for each device or software product — the guided threat & risk analysis, the Annex I risk assessment, requirement-to-development traceability, and a shareable conformity dossier. Many manufacturers run a GRC tool for organisational compliance and TRA Studio for their products.

No. It is a documentation aid that helps you produce and maintain the evidence. It does not issue certificates or constitute legal advice.

No. The guided workflow has an opinion and pre-fills templates per product class, so a small team can complete a TRA without an in-house specialist.

If you place products with digital elements on the EU market, very likely — the CRA has no SME exemption. Run the free CRA / NIS 2 check to find out where you stand.

NIS 2 targets your organisation's risk management and incident reporting once you are an essential or important entity (from roughly 50 staff or €10M turnover). The CRA targets the products you place on the market.

The full CRA set and the NIS 2 entity obligations are seeded out of the box, with IEC 62443-4-1 and BSI TR-03183 coming soon. You can import additional standards as JSON bundles.

Yes. The CRA / NIS 2 self-check is free, and Starter is free during the test phase until 31 October 2026.

Optional extras on top of a plan: additional users, more products / TRAs, extra standards packs, SBOM generation and priority support.

Yes. Plans are flat monthly with short terms, and annual billing saves two months.

In Germany, with EU data residency for the cloud service. An on-premise deployment is available for evaluation only.

MFA, an append-only audit log and full data export are built in, and security-relevant changes ship with tests.

Yes. TRA Studio is API-first: the backend exposes a documented REST API you can automate against. The full interactive reference is available once you're signed in.