EITC/IS/CRA Cyber Resilience Act

The programme uses a recurring professional loop: scope → assess → engineer → verify → release → monitor → respond → assure → reassess. Legal text is translated into product-specific decisions, controls and evidence without reducing cybersecurity to legal memorisation or a checklist exercise.

• Product and legal-factual model: identify the exact product, version, intended purpose, digital and remote-processing boundary, economic operators, open-source relationships, applicable exclusions, classification and adjacent regulatory interfaces.
• Risk and architecture: connect threat actors, weaknesses, trust boundaries and attack paths to Annex I requirements, security invariants, secure defaults, resilience behaviour, logging, recovery and verification.
• Lifecycle and supply chain: operate a Product Security Management System, control suppliers and open-source dependencies, create useful SBOM and VEX evidence, protect builds and signing, deliver secure updates and plan support and end-of-support transitions.
• Vulnerability and field operation: run coordinated vulnerability disclosure and PSIRT case management, assess Article 14 thresholds and deadlines, coordinate multi-regime facts, communicate with users and measure corrective-action effectiveness across the installed base.
• Conformity and market assurance: map requirements to standards and evidence, choose a justified conformity route, maintain Annex VII technical documentation, control declarations and CE marking, support importers and distributors, and respond to authorities.
• Continuous assurance and AI-era change: define evidence freshness, management review and reopen triggers; govern substantial-modification candidates; automate repeatable facts without automating accountability; and constrain and evaluate AI-enabled product functions.

The learning activities produce practical artefacts rather than only notes: product-boundary and role records, classification and route memoranda, Annex I applicability and risk registers, threat models and security invariants, secure-default specifications, release gates, supplier and dependency records, SBOM/VEX decisions, provenance and update controls, support-period plans, CVD and PSIRT workflows, Article 14 timelines, field-action dashboards, standards crosswalks, technical-file indexes, declaration and marking controls, market-surveillance response packs, continuous-control registers, change passports, evidence-pipeline records and AI security annexes.

• Lesson 1: CRA operating model, scope, roles, product classification and governance.
• Lesson 2: Risk-based secure-by-design engineering and essential product properties.
• Lesson 3: Secure product lifecycle, supply chain, SBOM and update operations.
• Lesson 4: Vulnerability handling, Article 14 reporting, post-market monitoring and crisis operation.
• Lesson 5: Standards, conformity assessment, technical documentation and market assurance.
• Lesson 6: Continuous CRA control operation, secure change, assurance automation and AI-era products.

EITC/IS/CRA assumes the general security literacy developed by EITC/IS/CSF and complements specialist EITCA/IS programmes in technical security, governance and operations. It is product-centred: EITC/IS/NIS2 remains the dedicated programme for entity scope, management accountability, national supervision and NIS2 incident duties, while GDPR, DORA, the AI Act and sectoral product rules may require separate applicability and reporting determinations. Shared facts and evidence should be reused where valid, but legal conclusions should not be merged without analysis.

The programme supports professional competence and implementation planning. It does not replace product-specific legal advice, the manufacturer’s accountable conformity decision, notified-body assessment, instructions of competent authorities or verification of the current legal and standards status. The content baseline is 23 June 2026; learners are repeatedly taught to preserve source status and review triggers as implementation acts, guidance, harmonised standards, reporting-platform instructions and national procedures evolve.