103% more reported CVEs per day in 2026 than last year.

CRA Compliance for Industrial IoT & ICS/SCADA

Secure your industrial control systems and maintain CRA and IEC 62443 compliance for manufacturing and critical infrastructure

Industrial IoT Fleet Management

Manage CRA compliance across thousands of industrial devices and control systems. CRACI tracks device inventory, firmware versions, and security status for your entire ICS/SCADA fleet. Monitor compliance in real-time and ensure all devices meet cybersecurity requirements for operational technology and critical manufacturing infrastructure.

Which versions are deployed to which products CRACI's inventory view shows exactly which software versions are deployed to which products, globally, and each version traces back to the build and SBOM that produced it. Inventory view Product Deployed version Web app v4.12.0 Mobile API v2.3.1 Gateway firmware v1.8.4 Sensor firmware v3.0.2 Each version traces back Version Build SBOM

IEC 62443 & ISO 27001 Compliance

Maintain compliance with IEC 62443 standards for industrial automation and control systems security. CRACI aligns with ISO 27001 and ISO 27002 best practices for information security management. Track security levels (SL 1-4), implement defense-in-depth strategies, and document compliance throughout the operational technology lifecycle.

Evidence from the build record SBOMs export as CycloneDX or SPDX, including the vulnerabilities found in their components, and the public REST API returns SBOMs, network traces and provenance, for customers, auditors and frameworks such as the EU Cyber Resilience Act, NIS2, FDA SBOM requirements and ISO 27001 supply chain controls. The build record SBOMs Vulnerability records Provenance Network traces Export CycloneDX SPDX REST API Who asks for it Customers Auditors Security reviews Frameworks this evidence supports EU Cyber Resilience Act NIS2 supply chain security FDA SBOM for cyber devices ISO 27001 supply chain controls

OT Network Security & Monitoring

Monitor and secure operational technology networks under CRA requirements. CRACI helps maintain great firmware security posture and to keeping SDKs up to date.

An egress policy on the build network A build job connects to hosts in its egress policy, such as package registries and Git, and a connection to a host outside the policy is blocked. The policy is validated before the job starts and fails closed, and a violation sends an alert. Egress policy Default deny Validated before the job starts Fails closed · 24 source presets Build job on a CRACI runner npm registry allowed PyPI allowed Git over HTTPS allowed Unapproved host blocked Alert on policy violation Connections are recorded in the job's network trace

Manufacturing & Critical Infrastructure

Purpose-built for industrial manufacturers and critical infrastructure operators. CRACI supports compliance requirements for factories, utilities, and essential services. Integrate with existing SCADA systems, PLCs, and industrial networks. Maintain comprehensive documentation aligned with ISO 27001 frameworks.

Embedded builds on CRACI runners Yocto and BitBake builds such as core-image-sato run on CRACI runners at size 32. Like every CRACI job, the build runs under an egress policy, records what it fetched and its provenance data. Embedded build bitbake core-image-sato Yocto and BitBake; pi-gen for Raspberry Pi OS CRACI runner, size 32 32 vCPU in an isolated virtual machine Egress policy Fetches recorded Provenance Firmware image SBOM recorded during the build

Secure your connected devices

Book a demo to manage security and compliance with CRACI

Book a demo