Certified CRA Lead Risk Assessor (CCRA-LRA) Certification Program by Tonex
The Certified CRA Lead Risk Assessor (CCRA-LRA) is an advanced certification for professionals who lead Cyber Resilience Act risk assessment programs across product portfolios.
This certification focuses on governance, assessment methodology, product classification, cross-functional evidence management, supplier risk, lifecycle assurance, and executive reporting.
Learning Objectives
Participants will learn how to:
- Lead CRA risk assessment programs across multiple products.
- Define organizational CRA risk assessment methodology.
- Classify products and prioritize CRA readiness activities.
- Establish CRA governance and accountability.
- Coordinate engineering, product, legal, compliance, and security teams.
- Integrate CRA with secure development lifecycle, SBOM, PSIRT, and conformity evidence.
- Develop executive dashboards and remediation roadmaps.
- Prepare organizations for CRA obligations in 2026 and 2027.
Target Audience
- Product security leaders
- Cybersecurity managers
- Compliance directors
- Risk managers
- Engineering leaders
- Regulatory affairs managers
- Product portfolio owners
- Internal auditors
- Consultants
Prerequisites
Recommended:
- Prior cybersecurity, risk, compliance, product security, or engineering leadership experience
- Completion of CCRA-PCRA™ or equivalent knowledge
Program Modules
Module 1: CRA Governance and Program Design
- CRA readiness roadmap
- Roles and responsibilities
- Product portfolio inventory
- Risk-based prioritization
- Executive reporting
Module 2: Product Classification and Scope Management
- Product categories
- Criticality
- Software-only and hardware/software products
- Supply chain dependencies
- Third-party components
Module 3: CRA Risk Assessment Methodology
- Standardized risk model
- Scoring criteria
- Control mapping
- Risk acceptance
- Residual risk
- Review cadence
Module 4: Portfolio-Level Risk Management
- Product risk heat maps
- Common control libraries
- Reusable evidence
- Product family assessments
- Supplier risk aggregation
Module 5: CRA Integration with SDLC and Product Lifecycle
- Secure development governance
- SBOM program
- Vulnerability handling
- Security updates
- End-of-support management
- Change management
Module 6: Conformity and Audit Readiness
- Technical documentation governance
- Evidence repositories
- Internal readiness reviews
- Corrective action plans
- Management review
Module 7: Capstone Assessment
Participants develop a CRA risk assessment program plan for a multi-product organization.
Exam Domains and Weights
| Domain | Weight |
| CRA Governance and Program Leadership | 20% |
| Product Classification and Portfolio Scoping | 15% |
| CRA Risk Assessment Methodology | 25% |
| Risk Treatment and Lifecycle Integration | 15% |
| Supplier and Software Component Risk | 10% |
| Documentation, Evidence, and Readiness Reporting | 15% |
Exam Format
- 40 multiple-choice questions
- 90 munites
- Scenario-based and leadership-level questions
- Passing score: 70%
Capstone Requirement
Candidates submit a CRA risk assessment program plan including:
- Product inventory model
- Risk assessment methodology
- Governance structure
- Evidence framework
- Vulnerability handling integration
- 2026/2027 readiness roadmap
Credential Validity
Valid for 3 years.