Hi, I'm David Knichel
I turn your existing architecture, security controls and engineering documentation into a structured Cyber Resilience Act (CRA) evidence package.
Start with a €950 Scope Assessment · see pricingWhat your evidence package contains
A structured repository connecting your product, its security decisions and the evidence behind them.
- Requirement-to-evidence mapping
- See which CRA requirements apply, how they are addressed, and where the supporting evidence lives.
- Cybersecurity risk assessment
- A product-specific assessment covering intended purpose, foreseeable use, attack scenarios, mitigations and residual risks.
- SBOM & component assurance
- A machine-readable software bill of materials (SBOM), with security-relevant dependencies, assumptions and third-party due diligence.
- Product & architecture evidence
- Clear documentation of the product boundary, interfaces, software and hardware components, remote data processing and external dependencies.
- Vulnerability & lifecycle procedures
- Documented processes for vulnerability intake, remediation, coordinated disclosure, CRA reporting, security updates and ongoing security review.
- Evidence gap register
- Anything that cannot yet be demonstrated is made explicit, together with the concrete engineering or documentation action needed to close the gap.
From a security decision to its evidence
Illustrative excerpt · not a client assessment
- Security objective
- Only authentic firmware updates should be installed.
- Product implementation
- The device verifies a signed update before installation.
- Supporting evidence
- Update architecture, signing-key procedure and signature-verification test results.
- Open gap and next action
- Evidence for rejecting a tampered update is missing. Run the negative test and attach its result.
Documentation records the engineering work; it does not replace it. If testing or a design change is needed, I identify and scope the gap and organize the resulting evidence. Additional engineering work is agreed separately.
Know the scope, cost and deliverables upfront
No hourly consulting project. Each engagement starts with a defined product, defined deliverables and a fixed scope.
CRA Scope Assessment
Start hereFor teams that first need certainty about what the CRA means for their product.
- CRA scope and product-boundary assessment
- Product classification and core-function analysis
- Remote data processing assessment
- Applicable conformity-assessment route
- High-level evidence requirements
- Initial gap assessment
- Recommended next steps
Delivered within 5 business days
Enquire about the assessmentCRA Evidence Package
For manufacturers preparing the evidence needed to demonstrate CRA conformity for one product or product family.
- Product and architecture documentation
- Cybersecurity risk assessment
- CRA requirements-to-evidence mapping
- SBOM and component assurance
- Third-party dependency assessment
- Vulnerability and update processes
- Support-period justification
- Security verification evidence structure
- Technical documentation
- Prioritized evidence and engineering gaps
Fixed scope and price agreed after the Scope Assessment.
Discuss your evidence packageWhy “from €2,900”?
Product complexity varies significantly. A single embedded device with a small software stack is fundamentally different from a product family with multiple applications, cloud components and external dependencies. The Scope Assessment establishes the boundary before any larger engagement begins.
A simple, low-overhead process
Remote and asynchronous by default, with clear points for your team's input.
Share what already exists
Share your existing product, architecture and security documentation. There is no need to prepare a compliance package first.
I assess the product and identify the gaps
I review the product boundary and existing evidence, then identify missing documentation and any technical work needed.
We close the evidence gaps
I build the documentation from your existing material. Your team receives prioritized actions where engineering input or testing is needed.
You receive a maintainable CRA evidence package
I hand over a structured repository linking requirements, assessments and supporting evidence, ready for your team to maintain as the product evolves.
- Remote
- Asynchronous by default
- Fixed scope
- Clear deliverables
Your sensitive product information stays protected
NDA before sharing technical information
Use your NDA or mine.
Minimum necessary access
Repository access is preferred where practical, but not required. Only the information needed for the assessment is requested.
Work in your environment when needed
Sensitive documentation and source code can remain in customer-controlled systems.
No unapproved third-party processing
Customer IP is not submitted to external AI or other third-party services without explicit approval.
You keep control of your IP, repositories and sensitive engineering data throughout the engagement.
Who you are working with
The same three threads run through every role: designing security architecture, meeting regulatory requirements, and writing the documentation that demonstrates both.
Explore my experience and education
Solution Architect · Edgeless Systems
Customer Integration, Solution engineering, Pre-sales, technical documentation, C5 attestation
Freelance security research & technical writing · Independent
Author security white papers, specifications and engineering documentation on confidential AI, 5G security and post-quantum cryptography, for both technical and decision-making audiences.
Enterprise Security Architect · CYMOTIVE Technologies
Systematic, function-based risk analysis of embedded systems for OEMs and Tier 1 suppliers, and the architectural decisions and written rationale that keep products compliant with automotive security regulations.
Dr.-Ing., summa cum laude · Ruhr University Bochum
Formal verification and automated masking of cryptographic hardware: proving security properties of designs and documenting the argument in peer-reviewed publications.
M.Sc. IT-Security / Information Technology · Ruhr University Bochum
Graded 96% (excellent). Embedded-system security, applied cryptography and secure system design — the foundation the later architecture and verification work builds on.
German IT Security Award 2022
Awarded for the verified, automated masking of cryptographic hardware — one of the most highly endowed cybersecurity prizes in the German-speaking world.
deutscher-it-sicherheitspreis.dePeer-reviewed research
Ten peer-reviewed publications at CHES, ACM CCS and Asiacrypt on masking, side-channel analysis and formal verification of cryptographic hardware.
Google ScholarTell me about your product
Send a short description of your product, its development stage and where you need help. Keep the first message non-sensitive; we can arrange an NDA before sharing technical details.
We agree the scope and required inputs before work begins. An enquiry does not commit you to an assessment.
- Fixed price
- No sales call required
- NDA available
- No ongoing commitment