CRA Compliance Guide:
What the Cyber Resilience Act Actually Requires
Four sessions. One security expert, one CRA lawyer, zero legal fluff. Codific’s CEO Aram Hovsepyan and tech lawyer Lara Brito break down the Cyber Resilience Act the way engineering teams actually need to hear it, through real examples, not abstractions.
CRA Compliance deadlines you can't ignore
The CRA isn’t a “read it when you get to it” regulation. Some of its obligations are already in force today. If your product has digital elements, here’s where things stand:
Vulnerability and incident reporting obligations are already active.
Full applicability lands; and if your team hasn’t started building security maturity yet, that’s less runway than it sounds like.
Non-compliance fines run up to €15 million or 2.5% of global turnover, whichever is higher.
What's covered in this CRA
compliance guide
Four sessions so far, more on the way as the series continues.
EPISODE 1
What is the CRA, and why should you care?
What counts as a “product with digital elements,” how the CRA compares (and doesn’t compare) to GDPR, the three product risk categories, and the actual dates you need to know.
Risk: No risk, no need for security
A practical walkthrough of risk assessment using the FAIR methodology, why “we answered all the checklist items” isn’t compliance, and how to build a defensible risk profile.
Requirements: Make the EU secure again
The technical requirements behind security by design and security by default — security requirements, architecture, third-party dependencies, and configuration hardening, explained with a real example, not a slide of buzzwords.
Vulnerability management: Tools, tools, tools
Why buying a scanner isn’t a vulnerability management program: incident detection, defect management, patching, and what actually counts as a “severe incident” under the CRA.
Who's teaching this
The CRA isn’t a “read it when you get to it” regulation. Some of its obligations are already in force today. If your product has digital elements, here’s where things stand:
Aram Hovsepyan
Aram Hovsepyan has spent close to two decades in application security; as a researcher, an industry expert, and now as part of the OWASP SAMM project. He’s Codific’s CEO, and he built the CRA framework used in this series on top of OWASP SAMM.
Lara Brito
Lara Brito is a tech lawyer and legal researcher who has worked closely with the CRA since it was still a proposal, she’s the one keeping Aram’s “real security” instincts honest against what the law actually says.
Watch the series free
GET INSTANT ACCESS.
Drop your email below and you’ll get instant access to all four sessions.
Questions, answered
Is this actually free?
Yes, completely free.
Do I need a legal or security background to follow along?
No. The whole point of the series is translating the CRA into plain language for people building products, not people writing legal briefs.
How long is each session?
20 – 30 minutes, structured around real examples rather than reading the regulation at you.
What happens after I sign up?
You’ll get an email with access to the videos right away, and occasional follow-ups as new episodes go live.