Training
Free EU Cyber Resilience Act training.
Briefings, walkthroughs and podcast episodes on the CRA, written for the people who carry the obligation. Watch or listen here, share them whole, and bring us the questions they raise.
Training library
Free to watch, listen to and share whole, with attribution. General information on Regulation (EU) 2024/2847 for training purposes — not legal advice. For any conformity decision, work from the Official Journal text.
The EU Cyber Resilience Act: executive briefing
For leadership, budget holders and the officer who signs the declaration of conformity.
What the CRA is and why a Regulation differs from a Directive, the scope test, the three dates that drive the plan, the reach-back of reporting into the installed base, penalty tiers, classification and what it costs, the eight standing vulnerability-handling duties, the support period as a balance-sheet commitment, and the decisions leadership has to make.
Recorded August 2026, before Article 14 reporting applied on 11 September 2026. Where it looks ahead to that date, the date has now passed and the reporting duty applies.
Narration is synthesised.
ENISA's Single Reporting Platform, walked through
For whoever in your organisation would file a CRA notification.
EU Login with multi-factor authentication, Primary and Secondary Assigned Representatives, choosing the CSIRT coordinator, the six dashboard queues, the two reportable event types, and the 24-hour, 72-hour, 14-day and one-month deadlines.
The reporting clock
For product security leads and the people who hold the pager.
The two triggers, the 24- and 72-hour clock, the final-report split most procedures merge, the reach-back into the installed base, and the four things that have to be true before a report can be filed.
Recorded August 2026, counting down to 11 September 2026 ("five weeks"). That date has passed; the clock it explains applies now.
Narration is synthesised. Dean Whitaker, who signs off, is a Malkan Solutions presenter persona, not a person.
CRA Executive Brief
Episode 1 — You Sign The Declaration
You sign the declaration
For device and equipment manufacturers, packaging and machine builders, and system integrators who private-label or substantially modify.
What the CRA means for a company that builds industrial equipment, role by role: the engineering leader and classification, the person holding the pager, finance and the support period, when an integrator becomes the manufacturer, machine builders and the Machinery Regulation, and why unfinished standards are not a reason to wait.
Recorded 5 August 2026, counting down to 11 September 2026; that date has passed. Incident details are as publicly reported on 5 August 2026.
Priya Raman and Dean Whitaker are Malkan Solutions podcast personas, and the narration is synthesised. The scripts are written and reviewed by Malkan Solutions; neither voice is a recording of a person.
CRA Executive Brief
Episode 2 — You Buy The Declaration
You buy the declaration
For asset owners and operators in water and wastewater, oil and gas, power and food and beverage, and the procurement teams who buy their OT.
The CRA does not regulate asset owners; it regulates the people who sell to them. What vendors are being made to do, in operator language; the procurement clauses that work and the phrase never to put in a tender; the overlap you should not pay for twice; and where the regulation genuinely does not help.
Recorded 5 August 2026, counting down to 11 September 2026; that date has passed. Incident details are as publicly reported on 5 August 2026.
Priya Raman and Dean Whitaker are Malkan Solutions podcast personas, and the narration is synthesised. The scripts are written and reviewed by Malkan Solutions; neither voice is a recording of a person.