EU CRA Cyber Resilience Act – Basics and Implementation of CRA
This training is primarily aimed at manufacturers of products with digital elements that fall within the scope of the EU regulation "Cyber Resilience Act" (CRA). After classifying the CRA in the legal framework of other EU regulations and directives as well as national laws, the training covers the requirements required by the CRA for products with digital elements and the requirements for the manufacturer's procedures for dealing with vulnerabilities. In addition, the obligations imposed on manufacturers by the regulation are dealt with. These include, in particular, the reporting obligations, but also the obligations relating to technical documentation and conformity assessment.
After clarifying the legal requirements, the training goes into the practical implementation with which these requirements and also the required compliance with the state of the art can be met. This is done in particular by using processes and measures from international standards such as ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27005, ISO/IEC 27034 and ISO/IEC 27035, but also from the BSI (Federal Office for Information Security) and NIST (National Institute of Standards and Technology).
Is your company already familiar with the CRA and the deadlines associated with it?
- 10.12.2024 Entry into force of the Ordinance
- 11.06.2026 Start of the requirements for conformity assessment bodies (Ch. IV)
- 11.09.2026 Start of reporting obligations for manufacturers in the event of vulnerabilities and security incidents (Art. 14)
- 11.12.2027 Full applicability of the CRA – all requirements must be met for new products
- Understand the legal requirements set by the CRA for products with digital elements and obligations to be fulfilled.
- Receive practical instructions
- Optimally prepare for the new legal requirements in order to continue to place products on the European market.
- Protect from sanctions and fines.
Legal basis, legal context and scope of the CRA as well as dates to be taken into account
- Economic operators concerned by the CRA
- Products and product classes that fall within the scope of the CRA and those that are explicitly excluded.
Basic cybersecurity requirements
- Basic cybersecurity requirements for affected products with digital elements, in particular secure configuration
- Basic cybersecurity requirements for the manufacturer's procedures for addressing vulnerabilities, in particular
Obligations for manufacturers, in particular
- Design, development, and manufacturing in accordance with basic cybersecurity requirements
- Technical documentation and user guidance
- Conformity assessment
- Information on the product
- Dealing with third-party components and software bill of materials
- Vulnerability Handling
- Security Updates
- Reporting obligations
Relevant authorities and their interaction
Obligations for other stakeholders and when the manufacturer's obligations also apply to them
Guidelines of the EU Commission
General obligations under the CRA (maintaining confidentiality) and sanctions
Instructions for practice based on international and national standards and norms:
- Secure development processes
- Risk Assessment and Threat Modeling
- Safe design
- Secure configuration
- Incident Management, Logging and Monitoring
- Vulnerability management and disclosure
- Specialist and managerial staff from product development, quality management, regulatory affairs, and IT security
- Manufacturers of digital products that are placed on the market in the EU
There are no special requirements for participation in this training.
- You know and understand the legal requirements and obligations imposed by the CRA for products with digital elements.
- You receive practical guidance for implementation.
- You are thus optimally prepared for the new legal requirements, enabling you to continue placing your products on the European market.
- You protect your organization against sanctions and fines.
Final Examination
- Online examination at the end of the program
- Open-book format
- Duration: 90 minutes
- Passing Criteria: Minimum 70% overall score
Certification
- Certificate issued upon successful completion of training and examination
- Certificate of Attendance issued to non-qualifying participants
1. When can I get the certificate?
EU CRA Cyber Resilience Act – Basics and Implementation of CRA certification will be issued within 21 working days from the examination date.
2. When can I get the training material and invite?
One day before the commencement of the training program.
3. How do I pay the fees for training and examination?
Online mode
4. What are the benefits of EU CRA Cyber Resilience Act – Basics and Implementation of CRA Program?
- Understand the legal requirements set by the CRA for products with digital elements and obligations to be fulfilled.
- Receive practical instructions
- Optimally prepare for the new legal requirements to continue to place products on the European market.
- Protect from sanctions and fines.
5. Is there any refund policy for the paid fees?
Please refer to Cancellation and Refund policy page.