CRA Manufacturer Certification Course
The CRA Manufacturer Certification Course is a free, exam-graded training programme covering what Regulation (EU) 2024/2847 requires of manufacturers. It is published at /academy/cra-manufacturer and requires no account: you enroll with your name and email, confirm the email through an activation link, and work through the material in the browser.
Curriculum
The course is eight modules, each with learning objectives, study text drawn from the official regulation, and links to the primary sources on EUR-Lex, the European Commission's Cyber Resilience Act pages, and ENISA (including recorded ENISA webinars embedded from the publisher's own channel).
- CRA foundations, timeline and scope — legal architecture, the staged application dates, Article 2 scope, Article 3 definitions, and the sectoral exclusions.
- Product classification — the default tier, Annex III Class I and Class II important products, Annex IV critical products, and why classification follows function.
- Annex I Part I: secure by design — the essential product requirements and the risk assessment that scopes them.
- Annex I Part II: vulnerability handling — SBOM, free security updates, coordinated disclosure, and secure update distribution.
- Article 13: manufacturer obligations — the lifecycle duty set, component due diligence, the support period, and Annex II user information.
- Article 14: reporting — the two triggers, the 24-hour, 72-hour, 14-day and one-month clocks, and reporting to the coordinator CSIRT and ENISA.
- Conformity assessment and CE marking — the Annex VIII routes, Annex VII technical documentation, the EU Declaration of Conformity, and CE marking rules.
- Economic operators and enforcement — importers, distributors, when a rebrander becomes the manufacturer, open-source stewards, market surveillance, and the penalty tiers.
Examination rules
Questions are single-best-answer items in the style of professional security certifications. Roughly a third are scenarios that test judgment rather than recall, and the correct option is deliberately not the longest one — an automated data-quality check enforces this across the whole bank, along with an even spread of the correct answer across all four positions.
Module quizzes. Ten questions sampled fresh from that module's bank, pass mark 70%, a maximum of three attempts per module. Answers and full explanations are shown after every attempt, with links to the source article or annex.
Final examination. Sixty questions drawn across all eight modules, ninety minutes, pass mark 75%, a maximum of three attempts in total. It unlocks only once every module quiz has been passed. Each attempt draws a different paper.
Two rules follow from keeping the examination meaningful:
- Starting an attempt consumes it. This prevents the question bank from being harvested by starting attempts, reading the questions, and abandoning them. If you close the page, reopening resumes the same paper — and for the final exam, the same clock.
- The final examination releases no answer key. You receive your score and a per-module breakdown to guide revision, but not per-question answers. Module quizzes are where explanations are given.
Attempt limits are enforced on the server and cannot be reset.
Certificate
Passing the final examination issues a certificate immediately and emails you the link. The credential is the CRA Manufacturer Certification — Foundational, issued by Porta Regulus B.V. (KvK 42062307, VAT NL869534208B01), the company that operates CVD Portal.
The certificate page is also the verification record: anyone holding the link — an employer, a customer, an auditor — can open it and confirm the credential is genuine. Certificate pages are excluded from search engine indexing because they carry a person's name behind an unguessable URL.
What a verifier sees, and what stays private
The link is safe to share, including on a public profile. It shows two different views depending on who opens it.
| Anyone with the link | You, the holder | |
|---|---|---|
| Name, credential, level, standing | Yes | Yes |
| Issue date | Month and year | Exact date |
| Curriculum version, certificate ID | Yes | Yes |
| Exam score and percentage | No | Yes |
| Employer | No | Yes |
Your score and employer are performance and personal data that do not help anyone answer "is this person certified", so they are never shown to a third party. You see the full record when you open the page in the browser you took the course in, where your course session identifies you.
The page is print-optimised. Use Print / Save PDF to produce a PDF copy.
Adding it to LinkedIn
An Add to LinkedIn button on your certificate page opens LinkedIn's add-a-certification form with the credential name, the issuer, the issue month and year, the certificate URL and the certificate number already filled in. The certificate email carries the same link.
The button appears only when you open the page yourself, not to anyone else holding the link — otherwise it would offer to add your credential to their profile. It is also withheld from a revoked credential.
No expiry date is sent, because the credential has none.
Machine-readable verification (Open Badges 3.0)
Alongside the human-readable page, every certificate is published as a signed Open Badges 3.0 assertion — a W3C Verifiable Credential — at:
/academy/cra-manufacturer/certificate/<code>/assertion.json
It is a compact JWS signed with Ed25519. The issuer is did:web:cvdportal.com, and the public key is published at https://cvdportal.com/.well-known/did.json, so a verifier can check the signature without contacting us for a key.
The assertion contains no email address and no holder name. Identity is bound as a salted SHA-256 hash of the holder's email, using the Open Badges IdentityHash form. Someone who already knows the email can confirm it matches; nobody can work backwards from the assertion to a person, and the per-credential salt means two credentials held by the same person cannot be correlated.
Revocation is carried by a hosted Bitstring Status List at /api/credentials/status-list, where each issued credential owns one bit. A verifier fetches the whole list and reads one bit, so checking a credential reveals nothing about which credential is being checked.
No expiry is present in the assertion, matching the credential itself.
Standing: valid, superseded, revoked
A certificate always displays its current standing.
- Valid — issued, current, and not withdrawn.
- Superseded — a newer curriculum version has been published since it was earned. The credential remains genuine and is not withdrawn; the label simply tells a reader that the syllabus has moved on.
- Revoked — withdrawn by the issuer, for example when a certificate was issued in error. A revoked certificate keeps resolving at the same URL rather than disappearing, so anyone holding an old link learns that it is no longer valid. The reason is shown only to the holder.
Expiry
The Foundational credential does not expire. There is no recertification deadline and no renewal fee.
The issue date does the work an expiry date would: it tells a reader which vintage of CRA guidance you were assessed against. CRA obligations do not lapse on an anniversary, and the harmonised standards will publish on their own schedule, so a countdown would imply a precision that does not exist. When the syllabus moves materially, the curriculum version is bumped and older certificates are marked superseded — visible, honest, and without invalidating what you earned.
Levels
The credential is issued at the Foundational level. That is a deliberate, accurate label: the exam is free, taken online, unproctored, and capped at three attempts, which supports a knowledge credential rather than an identity-verified professional qualification.
Higher tiers are planned as the CRA harmonised standards are published ahead of the December 2027 application date. They will be separate credentials with their own syllabus and a stronger integrity model, not an automatic upgrade of certificates already issued.
Notes and limitations
- The course is training material, not legal advice, and it is not an accredited or notified-body qualification. It demonstrates knowledge of the regulation's requirements.
- Because the course is free and account-free, enrolling a different email address starts a fresh set of attempts. The certificate names the email under which it was earned.
- A retake after certification keeps the original certificate ID, so links already shared stay valid.