EN 
DE The Cyber Resilience Act (CRA): A Practical Guide for Embedded Development
The Cyber Resilience Act (CRA) entails new, extensive obligations for manufacturers of connected products, from risk assessment over vulnerability management to technical documentation. Many companies struggle to implement these requirements in practice with reasonable efforts. This training will equip you with the necessary tools to tackle CRA compliance for your products on your own.
Introduction
- Overview of CRA including essential deadlines and penalties
- Presentation of the example used throughout the training: heat pumps
- Products with digital elements: definition, scope of the CRA and critical, important and default products
- Key terms: manufacturer, placing a product on the market, intended use, substantial change and support period
- Essential product properties for cybersecurity (Annex I.I)
- Principles: security by design and security by default
- Objective: Making available a product without known exploitable vulnerabilities with too high a risk
- Required characteristics: access control, confidentiality, integrity, availability, logging of security-related events, limitation of attack surfaces (“least privilege”)
- Mandatory practices: regular security updates, secure commissioning and decommissioning, data minimisation, minimisation of negative impact, containment of security incidents
- Risk assessment as a continuous process
- Lightweight risk assessment: data flow diagram of the product, threat modeling using Shostack’s four-question framework, documentation with security decision records (SDRs)
- Risk assessment with remote login via SSH as an example
- Requirements for addressing vulnerabilities (Annex I.II)
- Identifying and resolving vulnerabilities (security updates)
- Creating a Software Bill of Materials (SBoM)
- Practical tips for reducing 1,000+ Common Vulnerabilities and Exposures (CVEs) to the 10-20 most relevant CVEs
- Identifying and preventing vulnerabilities through regular testing: penetration tests, sanitisers, compiler hardening, etc.
- Encouraging third-party vulnerability reporting
- Template for the coordinated vulnerability disclosure (CVD) policy
- Reporting obligations of manufacturers from 11 September 2026: reporting, via the single reporting platform, actively exploited vulnerabilities and severe security incidents affecting the product
- Risk assessment and vulnerability assessment
- Completion of technical documentation (Annex VII)
- User information (Annex II)
- EU Declaration of Conformity (Annex V) including a sample declaration and a list of critical errors
- Cybersecurity requirements in the production process
- List of used harmonised and technical standards
- Test reports
- Diagrams and descriptions of the system architecture (partly met by data flow diagrams)
- Products placed on the market before 2028
- Free and open-source software
- All chapters are applied in a practical context using the example of a heat pump.
The training focuses on how to achieve CRA compliance with reasonable effort. The technical documentation is just one piece. What matters most is the actual implementation of the identified security measures and proof of their implementation.
The training provides a reference compliance for a heat pump including large parts of the technical documentation. This reference serves as a good starting point for the compliance of your own products.
By the end of the training, you’ll know how to structure and approach CRA compliance for your machine or device and how to derive, from risk assessment, a clear-cut plan for the necessary security measures.
You’ll also learn how to handle newly identified vulnerabilities in products already in the field.
Anyone who conducts CRA conformity assessments, implements the necessary security measures or is responsible for assessing business risks. This includes system architects, experienced developers, compliance managers and decision-makers in small and medium-sized enterprises.
Experience with embedded systems or in the application of technical standards for safety or cybersecurity
Empty do not delete
Onsite training: Individual workshops – tailored precisely to your project
In tailor-made workshops, we combine your specific project tasks with our training offerings. We take your requirements regarding content, time, location, duration, technical environment, and delivery method into account.
We will be happy to answer your questions.
Coaching with added value - expert knowledge for your project success
Our coaching offers have the great advantage that our experts contribute their knowledge and experience directly to your solution process and thus directly contribute to your project success.
| Date | Location | Language | Price ¹ | Duration | |
|---|---|---|---|---|---|
¹ Price per participant, in Euro plus VAT.
Training code: E-CRA
Empty do not delete
All inclusive!
The training price includes:
Lunch, soft drinks, tea and coffee, fruit, snacks,
training documentation and your MicroConsult training certificate.
Seminar location
In-person training:
MicroConsult Academy GmbH
Charles-de-Gaulle-Str. 6
81737 Munich, Germany
+49 89 450617-71
>> Directions and hotel information
Live online trainings:
Take place online via WebEx or Zoom.
Organizational details
Reservation / booking
You can make a non-binding training seat reservation at any time; we will keep the reservation for you for up to max. three weeks before the training starts.
To confirm your participation in a training, please submit a binding booking.
You can make the non-binding reservation as well as the binding booking online on the respective training page (button "Booking" or "Non-binding reservation").
Please also note our Bonus schedule when booking several trainings and/or participants at once.
Seminar location
MicroConsult Academy GmbH
Charles-de-Gaulle-Str. 6
81737 Munich, Germany
Phone: +49 89 450617-71 >> Directions
Training times (face-to-face training)
Please note:
Some trainings have different start/end times, so please take note of the times we send you with our order confirmation before the training.
One-day training: 08:30 - 17:00 h
Two-day training: Tag 1: 09:30 - 17:30 h / Tag 2: 08:30 - 17:00 h
Three-day training: Tag 1: 09:30 - 17:30 h / Tag 2-3: 08:30 - 17:00 h
Four-day training: Tag 1: 09:30 - 17:30 h / Tag 2-4: 08:30 - 17:00 h
4.5-day training: Tag 1: 09:30 - 17:30 h / Tag 2-4: 08:30 - 17:00 h / Letzter Tag: 08:30 - 13:00 h
Five-day training: Tag 1: 09:30 - 17:30 h / Tag 2-4: 08:30 - 17:00 h / Letzter Tag: 08:30 - 15:00 h
The structure of our live-online trainings is different to face-to-face trainings. Please refer to our registration confirmation for training times.
Training certificate
After the training, you will receive your MicroConsult Training Certificate to document the know-how you acquired.
Training documentation
High-quality, extensive training documentation is included in the training price.
Material
All you have to bring is thirst for knowledge and curiosity. Our seminar rooms are fully equipped with everything needed to run the training - including your training documentation and stationery.
Catering
We cordially invite you for lunch at a nearby restaurant and will provide you with free cold and warm drinks, snacks and fresh fruit during your stay.
Training environment
Our training rooms offer an open and friendly atmosphere and feature high-quality and modern training equipment.
Location
The MicroConsult training center is conveniently located and can be reached easily be public transport or by car. Several hotels are in close vicinity.
Click here for directions and hotel information.
Do you need assistance?
Please don't hesitate to contact us. For questions concerning the organization of face-to-face or online trainings, please contact our Service Office, phone +49 (0)89 450617-71. Or send an e-mail to training@microconsult.com.
Bonus schedule
Group discount: Binding registration of several attendees for the same training
Number of persons |
Discount |
| 2 to 3 | 5 % |
| 4 to 5 | 10 % |
| 6 and more | 15 % also over 2 different training dates |
| more than 8 | on request |
Quantity bonus: Binding registration of one attendee for several trainings
Number of trainings |
Discount |
|---|---|
| 2 trainings | 5 % |
| 3 trainings | 8 % |
| more than 3 trainings | on request |
Important information
Our bonus scheme only applies to open trainings.
To benefit from the bonus schedule for open trainings, a binding en-bloc registration as well as participation by all booked persons in the defined training are required. Basis for calculation is our current pricelist on www.microconsult.de.
The individual discount models cannot be combined with one another. Postponement of a training date by us or participation by a substitute do not affect the conditions.
Our bonus schedule is only valid for bookings directly submitted to us; bookings via external training portals are excluded from the bonus scheme.
Don't hesitate to contact us in case of questions. Feel free to call our Service Office at +49 (0)89 450617-71 or use the contact form.
Related trainings
Customer testimonials
Do need additional information? Feel free to get in touch!
Melanie Menzl
Organization open trainingsSilke Bluhm
Organization onsite trainings & coachingsNora Pohle
Saleskontakt@microconsult.com
+49 89 450617 - 71
Your benefits at a glance:
- 100 % practice orientation: You acquire knowledge that really matters in everyday project work – with real tools and proven methods, from experts from the real project world.
- How and where you want: Choose between live online or face-to-face trainings held in our training center or at your location.
- Small groups, big impact: Typically, the number of participants is max. 14 – this leaves room for your questions, your issues, and your practice.
- Comprehensible instead of complex: Complex content becomes tangible – through examples, interactive exercises, and a clear thread.
- Combinable: Ideal as an individual seminar or part of a training series.
- Sustainable learning success: You will receive high-quality documentation to reproduce what you learned.
- Flexible participation: Cancel or change your booking free of charge up to 3 weeks before the training – your booking remains transferable.