CRA workshop for manufacturers
In two days, your teams work out what the Cyber Resilience Act means for your products, where the biggest gaps are and which steps come first.
No obligation. We'll work out the details with you.
The questions manufacturers face
The CRA is an engineering topic, too
CRA reporting obligations have applied since 11 September 2026, and the full requirements apply from 11 December 2027. They reach into product development, architecture, documentation, operations and support.
Many manufacturers know they have to act, but not what that means for their products. In the workshop, we answer these questions for your products and turn the answers into concrete work packages.
Which of our products fall under the CRA?
Which requirements apply to machines, controllers, devices, software or cloud connections?
Which technical security measures have to go into the product?
Which processes do we need for secure development, vulnerability management and security updates?
What evidence does CE conformity require?
What applies to products already in the field, spare parts, retrofits and updates?
What role do EN 40000, IEC 62443, EN 18031 and ETSI EN 303 645 play?
What you have after two days
You leave the workshop with a foundation your CRA implementation can build on right away.
Typical results
- Prioritized next steps
- A first look at the gaps in processes, technical requirements and documentation
- An initial classification of your affected products and product types
- A basis for decisions by management, product management, engineering and quality
- The standards that fit your implementation
- A shared understanding of the CRA requirements across the team
Optional add-ons
- Concise results report
- Action list
- Initial roadmap
Use them to plan the budget and the project, and to prepare decisions for management.
Request the CRA workshopHow the two days run
Training, discussion and hands-on work sessions alternate. Depending on your goals, we tailor the workshop toward management, specialist teams or hands-on implementation.
Day 1: Understanding and scope
A shared understanding of the CRA and what it means for your products and organization.
- Overview of the CRA and the core manufacturer obligations
- Scope and which products are affected
- Roles and responsibilities in your company
- Requirements for the development process and organization
- Technical requirements for products
- First discussion of your product and process scenarios
Day 2: Implementation and next steps
Practical implementation, evidence and priorities.
- Cybersecurity risk assessment
- SBOM and supplier management
- Vulnerability handling and reporting obligations
- Support periods, updates and installed base
- Conformity, technical documentation and standards
- Your priority areas and next steps
The content in detail
Eight topic blocks cover the main requirement areas of the CRA, covering both what the regulation requires and how to implement it. In the work sessions, your teams apply them directly to their own products and processes.
Scope and applicability
Which products fall under the CRA, and what role do manufacturers, importers, distributors and authorized representatives play? Plus typical edge cases such as machines, embedded software, accessories, spare parts, retrofits, updates and cloud connections.
Development process requirements
Secure development, security governance, risk management, documentation, review, testing and release. And how to connect your existing processes with IEC 62443-4-1 and the upcoming CRA standards.
Technical product requirements
Secure configuration and defaults, access control, data protection, integrity, availability, logging, updatability and reducing vulnerabilities. Applied to your architectures based on risk, without generic checklists.
Cybersecurity risk assessment
How to identify, assess and document risks, derive requirements for design, security measures and evidence from them, and link the assessment to your engineering, safety and CE processes.
SBOM and supplier management
What information an SBOM realistically needs, what has to come from suppliers, how to account for open-source components and how to use the SBOM in vulnerability management.
Vulnerability handling and reporting obligations
Processes for vulnerability handling, coordinated vulnerability disclosure, security advisories, security updates and reporting, including the interfaces between engineering, product security, support, legal, regulatory affairs and communications.
Support periods, updates and installed base
How long products are supported, how updates are delivered and what applies to products already in the field, spare parts, retrofits and substantial modifications. The basis for your support policies and update strategies.
Conformity, evidence and standards
What evidence CE conformity requires, how the technical documentation can be structured and what role EN 40000, IEC 62443, EN 18031, ETSI EN 303 645, ISO/IEC 29147 and ISO/IEC 30111 play.
Who the workshop is for
Manufacturers of
- Machinery and plants
- Automation components and controllers
- IIoT and connected devices
- Embedded systems
- Software products
Who takes part
- Product management
- Engineering and architecture
- Quality management and regulatory affairs
- Information security
- Purchasing and supplier management
- Service and after-sales
- Executive or division management
Especially useful if
- you are just starting and want to set up CRA implementation in a coordinated way from day one
- several product lines need to be checked for CRA relevance
- departments don't yet agree on the target state
- there are security activities, but no end-to-end CRA approach
- you need a basis for budget and project planning
- you want to build on existing IEC 62443, CE, safety or quality processes
The workshop pays off most when you want to set up implementation together across your company and avoid a late, uncoordinated start.
Why Secuvise
Hands-on experience in product development and CE processes
Secuvise works with manufacturers on product security and cybersecurity regulation: CRA, RED Delegated Act, IEC 62443 and related standards.
Our focus is implementation in product development, product management, quality and technical documentation. That makes the workshop a particularly good fit for companies that need to integrate the CRA into existing engineering and CE processes.
350+ Compliant Products
Experience from audit, certification and implementation projects with industrial manufacturers.
40+ Manufacturers Supported
So we already know the questions your teams will bring to the workshop.
Training and work sessions combined
In the work sessions, your teams apply the requirements directly to your own product portfolio and organization.
Frequently asked questions
Is this a public training course or an in-house workshop?
The workshop is an in-house format for your company. We apply the requirements to your products, processes and organization.
Does the workshop take place online or on-site?
Both are possible. We agree on the format with you during planning.
How many people should take part?
Typically 6 to 15 people from the departments involved, such as product management, engineering, quality management, regulatory affairs and information security.
Can we set the focus ourselves?
Yes. Depending on your goals, we tailor the workshop toward management, specialist teams or hands-on implementation.
Do we need prior CRA knowledge?
No. Day one starts with an overview of the CRA and the core manufacturer obligations. Where you already have security activities in place, we build on them.
What does the workshop cost?
We'll quote you a price once focus, format and date are settled.
Prefer to talk?
Call us at +49 (0) 89 41627012 or send us a message using the request form.
Request the CRA workshopRequest the CRA workshop
What the CRA means for your products
After two days, your teams know which CRA requirements apply to your products, where the biggest gaps are and which steps come first.
- 1. Request No obligation, via the form or by phone
- 2. Agree on details We work out focus, participants, format and date with you
- 3. Get started Once you book, we run the two workshop days
Your details
We'll get back to you by email to agree on the details.