From Firmware to Conformity:
Putting the EU Cyber Resilience Act Into Practice
Linux Foundation Education, in partnership with AC6, has launched EU Cyber Resilience Act (CRA) for Embedded Systems (AC6403), an intermediate course that shows you how to turn CRA requirements into practical engineering and compliance decisions for the products you build.
For embedded teams, the EU Cyber Resilience Act (CRA) makes cybersecurity a requirement for products sold in the EU. From firmware protection and vulnerability management to software bills of materials (SBOMs), compliance must be considered throughout the product lifecycle.
This course shows you how to classify products under the CRA, apply secure firmware and update practices, manage vulnerabilities using SBOMs and CVE monitoring, and prepare the technical documentation needed for conformity assessment.
With this course, you’ll learn how to:
- Classify your product: determine whether it’s in scope and whether it’s default, important (Class I or II), or critical
- Turn essential requirements into design choices: secure defaults, firmware integrity, secure boot and update, and protected keys, plus security features in the Yocto Project and Zephyr RTOS
- Manage vulnerabilities through the support period: SBOMs, CVE monitoring, severity assessment, reporting obligations, and when a firmware update becomes a substantial modification
- Prepare for conformity assessment: risk assessment, technical documentation, the EU declaration of conformity, and CE marking
The course runs as a single instructor-led day, live online or in the classroom. You’ll work through a case study on an embedded system, with a live instructor on hand to answer questions as they come up. It’s built for embedded engineers, system architects, product managers, and compliance and test engineers.
You’ll leave knowing how to classify your product, where the essential requirements show up in your firmware and hardware design, how to assess the open source and third-party components you ship, and what your team needs in place to reach conformity.
