Risk Assessment for RED Cybersecurity Compliance

A risk assessment for RED cybersecurity is the systematic process of identifying what needs protection on your device, what threats exist, and whether your security measures are sufficient to meet EN 18031 requirements. Unlike generic enterprise risk assessments, the RED risk assessment is standards-driven: it follows the structure of EN 18031 sections, uses decision trees for each requirement, and produces a specific regulatory deliverable - the Declaration of Conformity.

Most cybersecurity risk assessment guides describe a generic enterprise process: inventory your IT assets, score threats by likelihood and impact, create a risk matrix, and prioritise mitigations. That approach does not map to the Radio Equipment Directive (RED).

RED cybersecurity compliance under Delegated Regulation (EU) 2022/30 - activating Articles 3.3(d), 3.3(e), and 3.3(f) - requires manufacturers to follow EN 18031, a harmonised European standard with a specific structure. The risk assessment is not freeform. It is anchored to:

Before any assessment work begins, you must determine which EN 18031 parts apply to your device. This decision drives everything downstream - which sections appear, which tables you must fill, and which decision trees you must complete.

The three parts correspond to different RED articles:

Most IoT devices require at least EN 18031-1. Many also require EN 18031-2 if they process personal data. A single project in RedComply can target any combination of parts, and the platform automatically filters sections and tables based on your selection using standard field inheritance rules.

Start by asking: does my device connect to a network? (Part 1 likely applies.) Does it collect, store, or transmit personal data? (Part 2 likely applies.) Does it handle financial transactions or stored value? (Part 3 likely applies.) When in doubt, include the part - it is better to assess and find requirements not applicable than to miss a mandatory section.

Asset identification is the mandatory first step of any EN 18031 risk assessment. Without knowing what needs protection, you cannot evaluate whether your security measures are sufficient. EN 18031 defines five categories of assets:

These are the mechanisms your device uses to enforce security. They fall into four subcategories:

These are the data values that security functions depend on. EN 18031 distinguishes between:

Depending on which EN 18031 parts apply, you must also identify network assets (network interfaces, protocols, data flows), privacy assets (personal data types collected, stored, or transmitted), and financial assets (payment credentials, stored-value mechanisms).

In RedComply, all asset categories have dedicated compliance tables. Once you populate the asset inventory, the platform automatically propagates identifiers into downstream assessment tables - access control, cryptography, vulnerability handling - so you never have to copy data manually.

Our guide to EN 18031 asset types covers each category in detail with practical examples.

With your assets catalogued, you now evaluate each EN 18031 requirement systematically. Unlike generic risk assessments where you assign subjective risk scores, EN 18031 uses decision trees - structured sequences of yes/no questions that lead to deterministic outcomes.

Each compliance table row can be linked to a decision tree. The tree presents a series of questions about your device's implementation. Based on your answers, the tree branches until it reaches one of three outcomes:

Decision tree questions are specific and binary. For example, in the access control section, a tree might ask: "Does the device enforce a minimum password complexity policy?" followed by "Is the policy configurable by the user?" Each answer directs you down a different branch. The tree records all responses in a structured `decisiontreeresponses` field, creating an auditable trail.

EN 18031 organises requirements into sections: Equipment Identification, Access Control Mechanisms, Vulnerability Handling, Cryptography, Software Update Mechanisms, Logging, and Network Monitoring (among others). For each section relevant to your device, you work through every table row, answering decision trees and recording justifications.

This is where the volume of work becomes apparent - and where tooling matters. A single device assessment can involve hundreds of decision tree completions across dozens of tables. RedComply tracks your progress section by section, highlights incomplete trees, and flags inconsistencies between related answers.

For a methodology-focused deep dive on vulnerability identification and audit documentation, see our vulnerability management guide.

Completing decision trees is not the end of the assessment. EN 18031 requires a three-tier test plan that validates your assessment outcomes with increasing rigour:

Each test plan row has verdict conditions - rules like "At least one PASS in column DT result" or "No FAIL entries present." These conditions are evaluated against your actual data to produce a final verdict. The priority order is: PASS > FAIL > NOT APPLICABLE. If data is incomplete, the system shows "-" rather than making assumptions.

In RedComply, verdict conditions auto-fill by detecting patterns in your data, and final verdicts are computed using pass/fail criteria masks from the EN 18031 templates. This eliminates manual calculation errors and immediately shows you where your assessment stands.

The final output of your RED risk assessment is the Declaration of Conformity (DoC) - the regulatory document that demonstrates your device meets the cybersecurity requirements of the Radio Equipment Directive.

The DoC compiles everything from your assessment:

The DoC is not a summary - it is a comprehensive record. Market surveillance authorities use it to verify that your assessment was thorough and that your conclusions are justified. Missing sections, incomplete tables, or undocumented decision tree branches can lead to compliance challenges.

RedComply generates the DoC as a structured PDF directly from your compliance data. Equipment identification renders vertically, assessment tables render horizontally, and all formatting (pick lists, extra-info splits, empty-table notices) is handled automatically.

If you are following the Module A self-assessment path, our self-assessment guide walks through the complete workflow.

It depends on the device complexity, the number of applicable EN 18031 parts, and whether you have tooling. A simple single-function IoT sensor might take days; a complex multi-radio gateway with personal data processing and payment capabilities could take weeks. AI-assisted tools like RedComply significantly reduce the time by automating table population, decision tree tracking, and verdict calculation.

Yes. Each device (or product variant with materially different hardware/software) requires its own assessment. However, devices sharing similar architectures can reuse compliance data as a starting point - you assess the differences rather than starting from scratch.

No. While frameworks like NIST CSF and ISO 27001 are valuable for organisational security, they do not provide a presumption of conformity with the RED cybersecurity requirements. EN 18031 is the harmonised standard that maps directly to Articles 3.3(d), 3.3(e), and 3.3(f). You may use other frameworks internally, but the regulatory documentation must follow EN 18031.

A FAIL outcome means the requirement is not currently met. You have two options: remediate (modify the device design or implementation to address the gap, then re-assess) or document the justification if you believe the requirement is not applicable to your specific device context. The key is that every FAIL must be addressed before the DoC can be considered complete.

No. The assessment applies to a specific version of a specific device. Any material change to the hardware, software, or firmware that affects the security properties of the device may require reassessment. This includes adding new network interfaces, changing cryptographic implementations, or modifying access control logic.

RedComply is purpose-built for EN 18031 and RED cybersecurity compliance. The platform guides you through every step of the risk assessment process - from scoping your standards to generating your Declaration of Conformity.

Here is how to start:

The built-in AI assistant helps you search the standard, understand requirements in context, and keep your assessment consistent across sections - so you can focus on the engineering decisions that matter.