TL;DR
🚀 The most direct route from signup to a signed MRCC, optimised by NexCyber experts.
⚡ Express path (Launch plan or above)
Week 1 — Foundation
- ✅ Create your account · invite your compliance lead
- ✅ Add your Regulated Product Estate (start with your flagship product)
- ✅ Run the Scope Review → see which frameworks apply
Week 2 — Evidence ingestion
- ✅ Upload your SBOM (CycloneDX 1.4+ / SPDX 2.3+)
- ✅ Map existing policies (security, vuln handling, incident response)
- ✅ Add supplier attestations for tier-1 dependencies
Week 3 — Close the gap
- ✅ Address top 3 gap priorities surfaced by RICE
- ✅ Re-upload refreshed evidence as needed
- ✅ Reach confidence threshold on at least 1 framework
Week 4 — Request MRCC
- ✅ Click Request MRCC on your estate
- ✅ Regulatory expert review + sign-off
- ✅ Receive signed PDF + public verify URL
🚦 Confidence thresholds (functional view)
| Framework | What you need at minimum |
|---|---|
| 🛡️ CRA | SBOM + vuln-handling policy + tech-doc skeleton |
| 🌐 NIS2 | 10 minimum measures mapped + supplier register |
| 🤖 AI Act | Risk tier classification + technical documentation |
| 📡 RED Cyber | 3.3.d/e/f sub-requirements evidence |
| 🏦 DORA | ICT third-party register + incident classification template |
Specific scoring methodology is part of our private model. Public-facing confidence is summarised in bands (preview / computed / evidence-backed / externally-linked).
💡 Pro tips
- 🎯 Start with one framework, not all five
- 📊 Aim for evidence-backed band before requesting MRCC
- 🤝 Loop in your auditor early — share Trust Passport URL
➡️ Next
💬 Need help?
- Reach out via our live chat (bottom-right) — Captain AI replies instantly, human experts within business hours.
- Email support@nexcyber.eu with
[P1]for Command/Strategic priority issues.
ℹ️ Disclaimer — RICE provides a readiness analysis, not legal advice. Final compliance may require legal review or notified body certification.
Last reviewed: 2026-06-02 · NexCyber Help Center