Cyber Resilience Act Training and PECB Certification: The Complete Guide
Article 14 reporting obligations apply from 11 September 2026. Certification pathways for the teams who have to classify, notify and evidence it.
What the CRA requires, and when
The Cyber Resilience Act, Regulation (EU) 2024/2847, sets binding cybersecurity requirements for products with digital elements placed on the EU market. It applies in stages. Reporting obligations under Article 14 start on 11 September 2026. The remaining obligations, including CE marking, the essential requirements and the software bill of materials in technical documentation, apply from 11 December 2027.
The first deadline is the operationally demanding one. From September 2026 a manufacturer must submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident affecting product security, a fuller notification within 72 hours, and a final report within 14 days. That is a capability question long before it is a documentation question.
This hub gathers the certification pathways that build the four capabilities the CRA actually tests: incident classification and notification, secure development and component inventory, supply chain security governance, and the entity-level programme that holds them together.
Who is affected
The CRA is a regulation, so it applies directly across the EU without national transposition. Scope follows the role, not the sector. A manufacturer is anyone who develops a product with digital elements and places it on the EU market under their own name or trademark, and that role carries the heaviest obligations. Company size is irrelevant.
Installable software, applications, plugins, SDKs and connected devices with firmware are in scope. Pure browser-delivered SaaS generally falls outside the CRA and into NIS2 instead. Non-commercial open source is exempt, though the regulation creates a lighter-touch open-source software steward role rather than a blanket exclusion.
Swiss manufacturers are in scope whenever they place products on the EU market, on the same basis as EU-established manufacturers. Article 14 also reaches products already sold, provided they remain on the EU market on or after 11 September 2026.
Courses
ISO 27034 Lead Application Security Implementer
For professionals turning application security requirements into operational controls using ISO/IEC 27034. Covers program structure, ONF design, and security integration across the application lifecycle. Delivered by practitioners; prepares for PECB certification.
ISO 27035 Lead Incident Manager
This four day advanced training prepares security professionals to design, run, and continuously improve an information security incident management capability aligned with ISO 27035:2023.
ISO 28000 Lead Auditor
This four-day ISO 28000 Lead Auditor course develops the competencies required to plan, conduct, and close supply chain security management system audits. The training integrates ISO/IEC 17021-1 requirements, ISO 19011 auditing guidelines, and ISO 28000 requirements. Participants learn audit principles, evidence- and risk-based auditing, audit team leadership, reporting, and follow-up on nonconformities. Exam fees are included, certification is available, and the exam is delivered online with a three-hour duration.
ISO 28000 Lead Implementer
This four-day ISO 28000 Lead Implementer course develops the capability to establish, implement, manage, and maintain a Supply Chain Security Management System aligned with ISO 28000:2022.
Lead Cybersecurity Manager
This Lead Cybersecurity Manager training prepares professionals to design, implement, and manage a cybersecurity program that stands up to real threats, regulatory scrutiny, and executive oversight.
NIS 2 Directive Lead Implementer
The NIS 2 Directive Lead Implementer is a 4-day PECB certification training program that equips professionals to implement a cybersecurity program compliant with the EU NIS 2 Directive. Participants sit the official PECB NIS 2 Lead Implementer certification exam at the end of the course.
Upcoming sessions
- ISO 27034 Lead Application Security Implementer — 24 Aug 2026 — Lausanne / Morges - Switzerland
- ISO 28000 Lead Implementer — 31 Aug 2026 — Lausanne / Morges - Switzerland
- NIS 2 Directive Lead Implementer — 28 Sept 2026 — Lausanne / Morges - Switzerland
- ISO 28000 Lead Auditor — 19 Oct 2026 — Lausanne / Morges - Switzerland
- Lead Cybersecurity Manager — 2 Nov 2026 — Lausanne / Morges - Switzerland
- ISO 27034 Lead Application Security Implementer — 16 Nov 2026 — Lausanne / Morges - Switzerland
Certification pathway for CRA readiness
ISO/IEC 27035 Lead Incident Manager
The Article 14 clock starts at the moment of awareness, not at the end of the investigation. ISO/IEC 27035 provides the classification and response structure that makes that moment definable, loggable and owned.
ISO/IEC 27034 Lead Application Security Implementer
You cannot report which products contain an exploited component within 24 hours unless you already know. ISO/IEC 27034 covers application security across the development lifecycle, which is where component inventory and SBOM discipline are actually built.
ISO 28000 Lead Implementer
NIS2 Article 21(2)(d) and the CRA both push supplier and component risk into scope. ISO 28000 provides a management system for security in the supply chain, rather than a recurring questionnaire exercise.
NIS 2 Directive Lead Implementer
Most organizations sit on both sides of the same risk: a NIS2 entity managing suppliers, and a CRA manufacturer being managed by customers. The evidence overlaps heavily when it is designed once.
Lead Cybersecurity Manager
The programme-level role that owns classification rules, notification routes and supplier governance across CRA, NIS2 and DORA reporting duties simultaneously.
Trainers for the CRA and supply chain pathway
Henri HAENNI
Expert in Business Continuity, Risk Management and Information Security Governance Consulting for large multinational corporations, government organization and internal organizations Certified international trainer and Lecturer at Sorbonne University Paris 1
Alexis HIRSCHHORN
Expert in Information and Cyber Security, Cloud Security, Risk Management and Governance Consulting for large multinational corporations, government entities and international organizations Management Systems Certified Lead Auditor
For the complete regulatory guide — transposition, obligations and compliance costs — read our article:
CRA Compliance 2026: The 11 September Reporting Deadline and What the LiteLLM Cascade Teaches Us
Article 14 of the Cyber Resilience Act applies from 11 September 2026: a 24-hour early warning for actively exploited vulnerabilities. What to fix in 30 days, and what the LiteLLM cascade exposed.
Read the full article →Train with practitioners. Pass with confidence.
Abilene Academy is the only PECB Titanium Partner in Switzerland — the highest accreditation tier in the industry — delivering certified training in information security, data protection, AI governance, and GRC compliance. 99% exam pass rate. 2,500+ professionals trained across 120+ countries and trusted by 600+ organizations. Multilingual programmes available.
- 99%
- Exam pass rate
- 2,500+
- Professionals trained
- 120+
- Countries reached
- Titanium
- The only PECB Titanium Partner in Switzerland
- ✓
- Certification included
- Multilingual
- EN · FR · ES · DE · IT and more