The Cyber Resilience Act (CRA): A Practical Guide for Embedded Development

The Cyber Resilience Act (CRA) entails new, extensive obligations for manufacturers of connected products, from risk assessment over vulnerability management to technical documentation. Many companies struggle to implement these requirements in practice with reasonable efforts. This training will equip you with the necessary tools to tackle CRA compliance for your products on your own.

Ziele -
Ihr Nutzen

The training focuses on how to achieve CRA compliance with reasonable effort. The technical documentation is just one piece. What matters most is the actual implementation of the identified security measures and proof of their implementation.
The training provides a reference compliance for a heat pump including large parts of the technical documentation. This reference serves as a good starting point for the compliance of your own products.
By the end of the training, you’ll know how to structure and approach CRA compliance for your machine or device and how to derive, from risk assessment, a clear-cut plan for the necessary security measures.
You’ll also learn how to handle newly identified vulnerabilities in products already in the field.

Teilnehmer

Anyone who conducts CRA conformity assessments, implements the necessary security measures or is responsible for assessing business risks. This includes system architects, experienced developers, compliance managers and decision-makers in small and medium-sized enterprises.

Voraussetzungen

Experience with embedded systems or in the application of technical standards for safety or cybersecurity

Inhalt

• Overview of CRA including essential deadlines and penalties
• Presentation of the example used throughout the training: heat pumps

• Products with digital elements: definition, scope of the CRA and critical, important and default products
• Key terms: manufacturer, placing a product on the market, intended use, substantial change and support period

• Essential product properties for cybersecurity (Annex I.I)
• Principles: security by design and security by default
• Objective: Making available a product without known exploitable vulnerabilities with too high a risk
• Required characteristics: access control, confidentiality, integrity, availability, logging of security-related events, limitation of attack surfaces (“least privilege”)
• Mandatory practices: regular security updates, secure commissioning and decommissioning, data minimisation, minimisation of negative impact, containment of security incidents
• Risk assessment as a continuous process
• Lightweight risk assessment: data flow diagram of the product, threat modeling using Shostack’s four-question framework, documentation with security decision records (SDRs)
• Risk assessment with remote login via SSH as an example

• Requirements for addressing vulnerabilities (Annex I.II)
• Identifying and resolving vulnerabilities (security updates)
• Creating a Software Bill of Materials (SBoM)
• Practical tips for reducing 1,000+ Common Vulnerabilities and Exposures (CVEs) to the 10-20 most relevant CVEs
• Identifying and preventing vulnerabilities through regular testing: penetration tests, sanitisers, compiler hardening, etc.
• Encouraging third-party vulnerability reporting
• Template for the coordinated vulnerability disclosure (CVD) policy
• Reporting obligations of manufacturers from 11 September 2026: reporting, via the single reporting platform, actively exploited vulnerabilities and severe security incidents affecting the product

• Risk assessment and vulnerability assessment
• Completion of technical documentation (Annex VII)
• User information (Annex II)
• EU Declaration of Conformity (Annex V) including a sample declaration and a list of critical errors
• Cybersecurity requirements in the production process
• List of used harmonised and technical standards
• Test reports
• Diagrams and descriptions of the system architecture (partly met by data flow diagrams)

• Products placed on the market before 2028
• Free and open-source software

• All chapters are applied in a practical context using the example of a heat pump.

Termine

16.11.2026 - 20.11.2026 | Preis (netto): 0,00 € (zzgl. USt.) | Dauer: 5 Tage

16.11.2026 - 20.11.2026 | Preis (netto): 0,00 € (zzgl. USt.) | Dauer: 5 Tage

Anmeldecode:

E-CRA