CVDPortal Reviews & Product Details

CVD Portal is a compliance platform for the EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847). It helps manufacturers of hardware and software products with digital elements meet every CRA obligation from one product record, from classification to Article 14 vulnerability reporting. From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA and the national CSIRT, with a 24 hour early warning, a 72 hour notification and a final report. From 11 December 2027, the full regulation applies, including the Annex I essential requirements, the technical documentation, the EU Declaration of Conformity and CE marking. What CVD Portal does: - Product classification. A free classifier resolves each product to default, important Class I, important Class II or critical under Annex III and Annex IV, and derives the Article 32 conformity route. - Coordinated vulnerability disclosure. A free whitelabel disclosure portal under your own brand, with a hosted RFC 9116 security.txt, PGP support and 48 hour acknowledgment tracking. - Article 14 reporting. Timers for the 24 hour, 72 hour and final report deadlines, and filing packages prepared for the ENISA Single Reporting Platform. The final submission to the authority stays a human action. - Risk assessment. A STRIDE risk assessment per product, with likelihood and impact scoring, mapped to the Annex I requirements it makes applicable. - Annex I and technical documentation. An applicability decision for every Annex I requirement, with evidence or a justification, and the Annex VII technical file, the EU Declaration of Conformity and the simplified declaration generated from the same record. - SBOM and advisories. SBOM import in SPDX 2.3 and CycloneDX 1.6, component vulnerability matching, and CSAF 2.0 advisories with VEX. - Audit trail. A hash-chained audit log and point-in-time snapshots of the technical file for each release. - Cross-framework evidence. Controls mapped to ISO 27001, NIS2, DORA and NIST CSF 2.0, so evidence is collected once. Who uses it: product security, compliance and engineering teams at manufacturers that place connected devices, industrial equipment or software on the EU market, and the consultants who support them. Data residency: customer data, analytics and logs stay in the European Union on every plan. CVD Portal is built by Porta Regulus B.V. in Amsterdam. Pricing: the Free plan costs €0 per month and covers the disclosure portal. Reporting is €99 per month and Compliance is €299 per month. Enterprise pricing is on request. New accounts get a 14 day free trial of the paid features.