The EU Cyber Resilience Act (CRA) is a significant piece of legislation that establishes a common set of standards and requirements on various types of software, including open source, to ensure cybersecurity and resilience. Products will bear the CE marking to indicate that they comply with the CRA requirements.
The CRA entered into force on the 10th December 2024 with parts of the act coming into place with the full act coming into force on 11 December 2027.
Key requirements of the act:
- The Act mandates compliance strategies for digital products and outlines how to navigate uncertainties in the law, particularly for open source software
- It includes provisions for ICT risk management, incident reporting, resilience testing, and third-party risk management
To help gain and understanding of the CRA, The Linux Foundation and Open SSF have recently launched a course: The Linux Foundation – Understanding the EU Cyber Resilience Act (CRA) (LFEL1001)
I have to thank a former colleague for posting about it on LinkedIn which drew my attention to the course. Having taken the the course I found it to be very informative and provides a good overview. There are useful links and material that can be used for further research into the CRA.
The course is presented in 4 chapters which cover:
- Course Introduction
- CRA Overview and Key Concepts
- Requirements and Conformity Assessments
- Adapting to the CRA
Upon taking a final exam, a digital badge is awarded.

I would recommend the course to anyone wanting a greater understanding of CRA and looking to implement it.

Its been a while since my last blog post, mainly because of studying to take an exam following a course on ServiceNow Administration so my mind has been on passing this.