Security Basics: Fundamentals of the Cyber Resilience Act (CRA)

The Cyber Resilience Act (CRA) imposes obligations on manufacturers and distributors of products with digital elements. From “security by design” and secure updates to reporting requirements for security incidents: in this course, participants will gain a clear overview of how the CRA, NIS2, and product liability interact, which products are affected, and which requirements truly matter.

Objective and Benefits

You will understand the requirements of the Cyber Resilience Act, be able to assess its impact on your company, and learn specific steps for targeted implementation. You will discover ways to minimize liability risks and strengthen cyber resilience in the long term.

Agenda

1. CRA Fundamentals

• Motivation
• verview of the CRA in relation to other regulations and directives (CRA, NIS2, Product Liability Act, etc.)
• Scope of Application (Which products are affected?)
• Key Requirements of the CRA
• Standards for Meeting CRA Requirements (IEC 62443, IEC 81001, etc.)
• Security Incidents & Reporting Obligations

2. CRA Requirements for the Product Development Process

• Project Management
• Risk-Based Requirements Gathering
• • Security Context
  • Threat Analysis
  • Risk Assessment
• Design
• • Defense in Depth
• Implementation
• Validation and Verification
• Documentation

3. CRA Requirements for Vulnerability Management

• Receipt of vulnerability reports from external and internal sources
• Review of vulnerability reports
• Assessment of vulnerability reports
• Addressing vulnerability reports
• Resolution of vulnerability reports

Target Audience

Executives, system development and project management professionals, compliance officers, IT managers 

Prerequisites

None.