Regulatory compliance

Threat Modeling and the CRA

The CRA doesn't assess how secure your product is. It assesses what you can prove. This short course covers what Regulation (EU) 2024/2847 asks of manufacturers, scope, the essential requirements, and the reporting clock that's already running, and shows where threat modeling carries the weight, including why your risk assessment is the thing that decides which requirements apply to you in the first place. Nine videos, one worked example followed end to end, and an honest account of the duties threat modeling can't solve for you.

  • Course duration

    ~ 30 min

  • Chapters

    3

  • Difficulty

    Beginner

  • Cost

    Free of charge

  • Badge

    Included

  • Certification

    Included

    Audience

    • Product security engineers and security architects — you'll run the threat models and own the trust boundaries
    • Engineering leads and managers shipping connected products, software or hardware, into the EU
    • Product security and compliance leads who own the technical file and the conformity route
    • Product managers — scoping and support-period decisions are commercial calls before they're technical ones
    • DevOps and platform engineers — the evidence-from-the-pipeline and pull-request material is yours
    • Executives and legal counsel — videos 1, 3 and 7 alone give you the scope, the deadlines and what needs budget

    Learning Objective

    By the end of the course, learners will be able to:

    • What the Cyber Resilience Act asks of manufacturers, and the deadlines that already apply
    • How to work out whether your product is in scope, and what that means for how you get assessed
    • Why your risk assessment decides which security requirements you actually have to meet
    • How to build a threat model that holds up as evidence, not just as a design exercise
    • How to connect a threat to a control, and a control to proof someone else can check
    • What happens after you ship — vulnerability handling, disclosure, and the reporting clock
    • When a change to your product means the model, or the compliance position, has to be revisited
    • Which duties threat modeling can't solve for you, and who needs to own them
    • Where a threat modeling platform makes this sustainable over the years