Skip to main content

CRA Data Institute

The CRA Data Institute publishes open data on how ready EU manufacturers are for the Cyber Resilience Act. It is a research property of CVD Portal, operated by Porta Regulus B.V.

What we publish​

We measure the public signals that a manufacturer can be reached about a security problem. That includes an RFC 9116 security.txt file and a discoverable coordinated vulnerability disclosure policy. We publish the aggregate results, the full method, and the raw dataset. Every dataset carries a CC BY 4.0 licence and a citation string, so anyone can reuse it with attribution.

Principles​

  • Aggregate only. We never publish a single company name or a per-company result.
  • Primary sources. Every figure traces to a dated scan and a documented frame.
  • Reproducible. The method is published in full next to the numbers.
  • Open licence. All data is CC BY 4.0.

Start here​

  • Datasets lists the current studies and their downloads.
  • Methodology explains how the numbers are produced.

Who runs it​

CVD Portal is a compliance platform for the EU Cyber Resilience Act, operated by Porta Regulus B.V. The research hub on the main site is at cvdportal.com/research. Reach the research team through cvdportal.com/contact. This property is independent of the European Union.