KONFORMA
DE

Continuous CRA monitoring for connected products

Know when your product needs a new security review.

KONFORMA monitors your releases, flags security assessments that need reviewing, and keeps decisions and evidence together.

Built for embedded, IoT and industrial product teams.

See how it works
Free readiness check

4 questions · no signup

Product · release

Gateway X · Firmware 2.5

Review required
Component
OpenSSL 3.0.11
Earlier assessment
Previously assessed: not affected
Trigger
Required supplier evidence expired
Next step
Renew evidence and review assessment
Illustrative example · sample data

CycloneDX & SPDX imports · GitHub inventory import

See what changed. Know what to review.

New vulnerability information, changes to your release or expired evidence can reopen a recorded assessment. KONFORMA shows the reason so your team can review it.

01

New threat information

A previously assessed vulnerability is now listed as actively exploited.

02

Changed release

Components, configuration or hardware no longer match the recorded assessment.

03

Expired evidence

A document required by the assessment is no longer current.

Review the finding, record your reasoning and approve the assessment for that release.

Release comparison

New release. Start with what you’ve already assessed.

Compare releases to see what changed and which earlier assessments are proposed for reuse. Your team reviews and approves them for the new release.

Older releases stay in monitoring for their support period.

Gateway X · Firmware 2.4 → 2.5

Proposed for reuse
8
Need renewed review
2
Not yet assessed
1
Reuse requires approval for the new release. Example data.

Evidence connected to your products.

From your suppliers · KONFORMA Exchange

Know which assessments depend on supplier evidence.

Link accepted supplier evidence to components and releases. If required evidence expires or is withdrawn, see which dependent assessments need reviewing.

Supplier evidenceExpired
Linked releaseGateway X · 2.5
Review work2 dependent assessments
Example data

Exchange is available separately. Suppliers respond for free.

Explore supplier evidence →

For your customers · Product Trust Rooms

Share product status and selected evidence.

Choose the releases, status fields and issued evidence your customer can see. Preview the room before sharing. Set an expiry date or revoke access.

Shared releaseGateway X · Firmware 2.5
Monitoring active
Last successful scan
12.09.2026 · 08:40
Selected evidence
CRA Evidence Pack · issued 12.09.2026
Example recipient view · sample data

Current monitoring status and dated evidence stay separate.

See customer sharing →

From your inventory to a documented decision.

  1. 1

    Connect

    Upload your SBOM or import it from GitHub.

  2. 2

    Monitor

    Track vulnerabilities and changes to recorded assessment evidence.

  3. 3

    Decide

    Review impact and document your assessment.

  4. 4

    Report

    Assess reporting duties and prepare notification drafts.

  5. 5

    Prove

    Create reports and share selected evidence.

Keep client assessments under review.

Monitor supported releases between engagements, review changes and keep decisions documented in separate client workspaces.

KONFORMA for consultants →

Pricing

Monitoring for your product portfolio.

Annual plans. Exchange and partner arrangements are quoted separately.

Free Check

€0

  • 1 product · 1 release
  • Inventory import and vulnerability snapshot
  • Sample report
  • No ongoing monitoring
Start with the readiness check

The questionnaire is the first step. Inventory analysis follows after account setup.

Professional

Professional

€7,500 / year · excl. VAT

  • 10 products · 50 active releases
  • Daily vulnerability monitoring
  • Incident workflows and reports
  • Team access and audit trail
Discuss Professional

Business

€15,000 / year · excl. VAT

  • 30 products · 200 active releases
  • Vulnerability monitoring every 6 hours
  • Everything in Professional
Discuss Business

Enterprise, Exchange and consultant arrangements: contact us.

Frequently asked

What changes does KONFORMA track?

New vulnerability information, recorded changes to release inventory or context, and changes to linked evidence. Monitoring is based on the product data and evidence recorded in KONFORMA.

Does KONFORMA approve compliance automatically?

No. Your team reviews and approves assessments. KONFORMA tracks their recorded basis and supports documentation; it does not issue an automatic conformity approval.

Can we reuse earlier assessments?

Matching assessments recorded in KONFORMA can be proposed for another release. Your team must approve them for that release. Existing reports can inform your work, but are not automatically converted into monitored assessments.

How often does monitoring run?

Vulnerability scans run daily on Professional and every six hours on Business. Recorded changes and evidence validity are checked through their respective workflows. The free plan has no ongoing monitoring.

What can my customers see?

In a Product Trust Room, customers see the releases, status fields and issued evidence you select. Internal component lists, vulnerability details and assessment notes are not shown in the room.

Start with one product.

Explore how KONFORMA fits your releases, assessments and evidence.

Request a pilot

Not ready yet? Take the readiness check.