Course curriculum
5 modules · 17 lessons · ~3 hours of reading, plus a video walkthrough and a quiz on every lesson.
Foundations
FoundationsEverything every role must know: what the CRA is, who it binds, and when.
What the CRA is and why it exists
The first horizontal cybersecurity law for products with digital elements, and the market failure it targets.
Scope: products with digital elements and the risk classes
What counts as a product with digital elements, what is carved out, and how important/critical classification changes your workload.
Key dates and the transition timeline
What is already binding, what lands in September 2026, and what December 2027 means for products in development today.
Roles: manufacturer, importer, distributor, open-source steward
Who carries which duty in the supply chain, and how a role can change under your feet.
Secure by Design
EngineeringAnnex I Part I turned into concrete firmware engineering practice.
Annex I Part I — the essential security requirements
A requirement-by-requirement walkthrough of what your product must actually do.
Secure boot, root of trust and key management
Building the integrity chain on constrained hardware, and keeping the signing keys alive for a decade.
Secure update mechanisms and rollback protection
Designing an update path you can still rely on nine years from now.
SBOM: generation, formats and lifecycle
Making a machine-readable inventory of your firmware that stays true across releases.
Vulnerability Handling
EngineeringAnnex I Part II: the process obligations that run for the whole support period.
Annex I Part II — the vulnerability handling process
The eight process obligations that run for the whole support period.
Threat modelling and cybersecurity risk assessment
The document every other CRA obligation is justified against.
Testing, fuzzing and evidence you can show an auditor
Building a test programme that satisfies Annex I Part II (3) and produces documentation as a by-product.
Conformity & Documentation
ComplianceProving compliance: assessment routes, technical documentation, standards, CE marking.
Conformity assessment routes and modules
Choosing between self-assessment, type examination and full quality assurance.
Technical documentation (Annex VII) in practice
Assembling the file, and how to write it so it stays current across releases.
Harmonised standards and presumption of conformity
How standards reduce your burden, and what to do while they are still being written.
Reporting & Ongoing Obligations
ComplianceLife after placing on the market: reporting, surveillance, penalties, suppliers.
Reporting exploited vulnerabilities and severe incidents
The 24 / 72 hour / 14 day clocks, who you notify, and how to be ready before the clock starts.
CE marking, declaration of conformity and market surveillance
Closing the loop: what you sign, what you affix, and what happens when an authority calls.
Support period, suppliers and contracts
Turning a decade-long legal commitment into supplier terms you can actually enforce.