Top certifications for the EU Cyber Resilience Act (CRA)

Delegates have been asking which courses we recommend to help them remain compliant with the EU Cyber Resilience Act (CRA). The answer differs depending on whether you're preparing for compliance at an organisational or individual level.

To ensure CRA compliance, individuals and organisations should consider a combination of certifications, frameworks, and structured processes that align with core CRA requirements. While CRA doesn't mandate specific certifications, it does emphasise demonstrable Cybersecurity practices.

On that note, the most relevant certifications and frameworks to consider are:

For individuals:

1. ISC2 Certified Information Systems Security Professional® (CISSP®)

This widely recognised certification covers Governance, Risk, and Compliance (GRC), which are essential for CRA. CISSP® helps you develop the expert knowledge you need to implement and manage an Enterprise Security Programme (ESP) for your company. It is a key certification for professionals who aim for senior Cyber Security roles. Find out more.

2. ISACA Certified Information Security Manager® (CISM®)

ISACA's course focuses on managing and governing enterprise information security programmes. While CISSP® is more technical, CISM® has a more holistic and management-focused approach. This course is a complex, high-level certification programme that teaches you to manage, design, oversee, and assess Enterprise Information Security. Read more. 

3. ISC2 Certified Secure Software Lifecycle Professional® (CSSLP®)

Ideal for developers and engineers working on CRA-regulated products, CSSLP® is a comprehensive, vendor-neutral Cyber Security certification applicable to any tech stack. Specifically for the current climate, CSSLP® helps you develop the knowledge and skills to address AI-driven opportunities and challenges and position yourself as a leader in securing the future of technology, complying with government and industry regulations. Find out more.

4. EC-Council Certified Ethical Hacker® (CEH®)

Currently in its 13th version, EC-Council's CEH® helps you develop the skills you need to beat hackers at their own game and protect your business. The course provides extensive hands-on training, labs, assessment, mock engagement (practice), and global hacking competitions, which are very useful for vulnerability handling and penetration testing, key CRA requirements. See the full spec. 

For companies:

In-depth knowledge of the following frameworks will stand you in good stead as far as CRA is concerned:

1. ISO/IEC 27001: Information Security Management Systems (ISMS)

This well-known ISO standard can help you establish a systematic approach to managing sensitive company information and demonstrate a mature Cybersecurity posture aligned with CRA. You and your team can become certified in ISO 27001 Foundations or as Lead 27001 Implementers or Auditors. Find out more. 

2. ISO/IEC 62443: Industrial Automation and Control Systems Security (IACS)

Especially relevant for manufacturers of connected devices and industrial systems, ISO 62443 supports secure product development and lifecycle management.

3. Common Criteria (CC), formally known as ISO/IEC 15408

The CC provides a framework for evaluating the security properties of IT products and, as such, is useful for high-assurance products. 

4. The EU Cybersecurity Certification Scheme on Common Criteria (EUCC)

The EUCC is a new EU-wide certification scheme under the EU Cybersecurity Act. It's expected to be a key mechanism for demonstrating CRA compliance in the future, so familiarising yourself with it now is a wise choice. 

5. OWASP Software Assurance Maturity Model (SAMM)

Finally, another tool that is specifically mentioned as useful for CRA compliance is the OWASP SAMM, a system that helps organisations assess and improve their secure software development lifecycle (SDLC).

Depending on your industry and the size of your team, you can tailor a bespoke training programme to incorporate the standards above. Find out more.

Win a free Cybersecurity course, exam included!

You could win a free Cybersecurity certification course if you enter our quarterly draw, Competition Time. This quarter's lucky winner can attend their chosen Cybersecurity course for free, exam voucher included, by 30 November.

Enter now!