ENISA Survey Finds SMEs Still Face Gaps in Cyber Resilience Act Readiness

Summary

ENISA’s survey of 194 organisations across 31 countries found gaps between SMEs’ awareness of the Cyber Resilience Act and practical readiness, with microcompanies generally less mature and seeking templates and financial support.

Key points

• The ENISA SME CRA Survey was conducted in February and March 2026 and received responses from 194 organisations across 31 countries, including 25 EU Member States.
• Although 66% of respondents had heard of the Cyber Resilience Act, the findings indicate room to improve understanding of its practical requirements.
• Medium-sized companies scored about one point higher than microcompanies on average across the five product-security domains.
• Incident response and product life cycle management were the weakest areas overall, particularly for microcompanies.
• More than 70% of respondents requested technical documentation templates and secure development templates; 142 respondents highlighted the need for financial support.
• ENISA’s maturity model covers governance and documentation, risk management and secure design, vulnerability and patch management, product life cycle management, and skills and awareness.
• An advanced maturity score does not replace legal obligations or demonstrate compliance with the CRA.