Can SECURE pay for this?

SECURE decides. Put the check in your application as subcontracted work, with this quote; I start only after your sub-grant agreement is signed.

Services

CRA readiness check

Do you make software or connected products? Where you stand against the Cyber Resilience Act, with an ordered list of what is missing.

Small makers of software, apps and connected devices selling on the European market.

The Cyber Resilience Act (Regulation (EU) 2024/2847) has required manufacturers since 11 September 2026 to report actively exploited vulnerabilities and severe incidents; the essential requirements of Annex I apply from 11 December 2027.
If your company is in scope of the CRA, a CRA gap analysis can count as subcontracted work in an application to SECURE's second open call (until 11 December 2026), but only for work after the sub-grant agreement is signed. I do not guarantee funding or eligibility.

A gap register: per CRA requirement your current state, what is missing and the order to tackle it.
A procedure for reporting vulnerabilities and incidents, and for handling reports from outside.
A first start of the software bill of materials (SBOM) for one product.

The technical file and the EU declaration of conformity: those follow later, possibly as a separate engagement.
Testing or penetration testing of your product, and a certificate.

Can SECURE pay for this?: SECURE decides. Put the check in your application as subcontracted work, with this quote; I start only after your sub-grant agreement is signed.