MRCC & Trust Passport

The end goal of NexCyber - a Trust Passport you can share, and an MRCC Certificate signed by EU regulatory experts.

By NexCyber Support

• 5 articles

What is an MRCC Certificate?

TL;DR 📜 MRCC = Multi-Regulator Conformity Certificate. A single, structured artifact summarizing your readiness across multiple EU frameworks (CRA, NIS2, AI Act, RED, DORA). Signed by NexCyber's regulatory experts. Designed to be shared with auditors, customers, and partners. | ✅ What MRCC is | ❌ What MRCC is not | |---|---| | Structured readiness signal across frameworks | Not a notified body certification | | Issued after evidence reaches confidence threshold | Not your CE declaration | | Versioned, verifiable, shareable | Not a legal opinion | | Premium artifact of paid plans | Not a substitute for legal counsel | 🔍 What it includes - 📋 Scope statement — which estates, which frameworks - 🎯 Coverage map — obligations × evidence × confidence - 🛡️ Trust Passport reference — your underlying readiness graph - ✍️ Expert sign-off — NexCyber regulatory team signature - 🔗 Verify link — public verification endpoint (read-only proof) 📈 When you get one MRCC is automatically issuable once your estate hits the required confidence level on the relevant decision modules — Cross-Reg Decision Engine, Trust Passport, etc. (paid plans only). 🤝 How to share - Direct URL with verify link (public proof) - PDF export (signed, watermarked) - Embed badge on your site (post-issuance) ➡️ Next - 📊 Run an assessment to start - 🛡️ Trust Passport vs MRCC — which one? - 🚀 Fastest path to your first MRCC 💬 Need help? - Reach out via our live chat (bottom-right) — Captain AI replies instantly, human experts within business hours. - Email support@nexcyber.eu with [P1] for Command/Strategic priority issues. ℹ️ Disclaimer — RICE provides a readiness analysis, not legal advice. Final compliance may require legal review or notified body certification. Last reviewed: 2026-06-02 · NexCyber Help Center

Last updated on Jun 02, 2026

Trust Passport vs MRCC Certificate — which one do you need?

TL;DR 🛡️ Trust Passport = your living readiness graph. MRCC Certificate = signed snapshot you share with auditors. | | 🛡️ Trust Passport | 📜 MRCC Certificate | |---|---|---| | Nature | Living, continuously updated | Snapshot, signed by experts | | Audience | Internal, prospects, partners | Auditors, regulators, key customers | | Issuance | Auto from your assessments | Issued at confidence threshold | | Shareable | Yes (link or embed) | Yes (PDF + verify URL) | | Plan | Starter+ | Launch+ | 🎯 Which one for which moment? | You want to… | Use | |---|---| | Show readiness on your website footer | 🛡️ Trust Passport | | Reply to a vendor security questionnaire | 🛡️ Trust Passport + 📜 MRCC excerpt | | Pass an enterprise customer audit | 📜 MRCC Certificate | | Demonstrate readiness to a notified body | 📜 MRCC + your own technical file | | Track your own progress quarter over quarter | 🛡️ Trust Passport (with trend) | 🔗 Together You always own a Trust Passport first. Once your readiness crosses the threshold for one or more frameworks, you can request the MRCC to be issued as a signed snapshot. ➡️ Next - 📋 What is an MRCC Certificate? - 🚀 Fastest path to your first MRCC 💬 Need help? - Reach out via our live chat (bottom-right) — Captain AI replies instantly, human experts within business hours. - Email support@nexcyber.eu with [P1] for Command/Strategic priority issues. ℹ️ Disclaimer — RICE provides a readiness analysis, not legal advice. Final compliance may require legal review or notified body certification. Last reviewed: 2026-06-02 · NexCyber Help Center

Last updated on Jun 02, 2026

How the MRCC process works step by step

TL;DR 📜 Five steps from assessment to issued MRCC Certificate. 🪜 The 5 steps 1️⃣ Define your Product Estate One estate = one product / one codebase-SBOM lineage / one EU market exposure. 👉 Add your first regulated product 2️⃣ Run your Scope Review RICE maps which EU frameworks apply (CRA, NIS2, AI Act, RED, DORA, combos). 👉 How NexCyber decides which regulations apply 3️⃣ Close your Compliance Gap Upload evidence (SBOM, policies, test reports, supplier attestations). Confidence levels update automatically. 👉 Build your evidence library 4️⃣ Reach the confidence threshold Each framework has a confidence threshold. When you cross it, your estate becomes MRCC-eligible. 👉 Reading your assessment results 5️⃣ Request the MRCC - Open your estate - Click Request MRCC - Our regulatory team reviews and signs - You receive a signed PDF + a public verify URL ⏱️ Typical timeline | Plan | First MRCC turnaround | |---|---| | Launch | 5-10 business days | | Portfolio | 3-5 business days | | Command | 1-3 business days (priority queue) | | Strategic | Contractual SLA | ➡️ Next - 🚀 Fastest path to your first MRCC - 🛡️ Trust Passport vs MRCC - 🔗 Share your Trust Passport 💬 Need help? - Reach out via our live chat (bottom-right) — Captain AI replies instantly, human experts within business hours. - Email support@nexcyber.eu with [P1] for Command/Strategic priority issues. ℹ️ Disclaimer — RICE provides a readiness analysis, not legal advice. Final compliance may require legal review or notified body certification. Last reviewed: 2026-06-02 · NexCyber Help Center

Last updated on Jun 02, 2026

Share your Trust Passport with customers and auditors

TL;DR 🛡️ Three ways to share your Trust Passport — pick the right one for your audience. 🔗 Sharing options | Method | Best for | What recipient sees | |---|---|---| | Public URL | Sales prospects, partners | Read-only readiness summary, no evidence files | | Embedded badge | Your website / footer | Live, auto-updated trust signal | | PDF export (signed) | Vendor questionnaires, RFPs | Static snapshot, watermarked | | MRCC excerpt | Auditors, enterprise customers | Cross-framework signed attestation | 🛡️ What's exposed publicly - ✅ Frameworks in scope (CRA, NIS2, AI Act, RED, DORA) - ✅ Confidence band per framework (high / medium / preview) - ✅ Last updated date - ✅ Verifiable URL 🔒 What's never exposed - ❌ Your uploaded evidence files - ❌ Specific gap details - ❌ Internal scoring methodology - ❌ Sensitive contract or supplier info ⚙️ How to share 1. Open your estate 2. Click Trust Passport → Share 3. Choose your method (URL / badge / PDF) 4. Set audience (public / authenticated-only) ➡️ Next - 📜 What is an MRCC Certificate? - 🪜 How the MRCC process works 💬 Need help? - Reach out via our live chat (bottom-right) — Captain AI replies instantly, human experts within business hours. - Email support@nexcyber.eu with [P1] for Command/Strategic priority issues. ℹ️ Disclaimer — RICE provides a readiness analysis, not legal advice. Final compliance may require legal review or notified body certification. Last reviewed: 2026-06-02 · NexCyber Help Center

Last updated on Jun 02, 2026

Fastest path to your first MRCC Certificate

TL;DR 🚀 The most direct route from signup to a signed MRCC, optimised by NexCyber experts. ⚡ Express path (Launch plan or above) Week 1 — Foundation - ✅ Create your account · invite your compliance lead - ✅ Add your Regulated Product Estate (start with your flagship product) - ✅ Run the Scope Review → see which frameworks apply Week 2 — Evidence ingestion - ✅ Upload your SBOM (CycloneDX 1.4+ / SPDX 2.3+) - ✅ Map existing policies (security, vuln handling, incident response) - ✅ Add supplier attestations for tier-1 dependencies Week 3 — Close the gap - ✅ Address top 3 gap priorities surfaced by RICE - ✅ Re-upload refreshed evidence as needed - ✅ Reach confidence threshold on at least 1 framework Week 4 — Request MRCC - ✅ Click Request MRCC on your estate - ✅ Regulatory expert review + sign-off - ✅ Receive signed PDF + public verify URL 🚦 Confidence thresholds (functional view) | Framework | What you need at minimum | |---|---| | 🛡️ CRA | SBOM + vuln-handling policy + tech-doc skeleton | | 🌐 NIS2 | 10 minimum measures mapped + supplier register | | 🤖 AI Act | Risk tier classification + technical documentation | | 📡 RED Cyber | 3.3.d/e/f sub-requirements evidence | | 🏦 DORA | ICT third-party register + incident classification template | Specific scoring methodology is part of our private model. Public-facing confidence is summarised in bands (preview / computed / evidence-backed / externally-linked). 💡 Pro tips - 🎯 Start with one framework, not all five - 📊 Aim for evidence-backed band before requesting MRCC - 🤝 Loop in your auditor early — share Trust Passport URL ➡️ Next - 🪜 How the MRCC process works - 📜 What is an MRCC Certificate? - 🔗 Share your Trust Passport 💬 Need help? - Reach out via our live chat (bottom-right) — Captain AI replies instantly, human experts within business hours. - Email support@nexcyber.eu with [P1] for Command/Strategic priority issues. ℹ️ Disclaimer — RICE provides a readiness analysis, not legal advice. Final compliance may require legal review or notified body certification. Last reviewed: 2026-06-02 · NexCyber Help Center

Last updated on Jun 02, 2026