Intermediate2h 49m # IoT Cybersecurity Compliance Course: EN 18031 & CRA Cybersecurity compliance for connected electronics: RED Delegated Regulation 2022/30, EN 18031-1/-2/-3, the CRA transition, plus UK and US rules. Connected electronics sold in the EU must meet mandatory cybersecurity requirements under Delegated Regulation (EU) 2022/30 — in force since 1 August 2025 and enforced through the Radio Equipment Directive. Almost every internet-connected consumer electronics product, IoT device, wearable, smart home device, and connected toy is now in scope. This course teaches the complete compliance process: how the regulatory framework works, which products are covered under Article 3(3)(d)(e)(f), how the three harmonised EN 18031 standards translate into engineering requirements, how to choose between self-assessment and Notified Body certification, how to build a compliant technical documentation file, and how to prepare for the transition to the EU Cyber Resilience Act, which replaces RED cybersecurity requirements on 11 December 2027. The course covers Article 3(3)(d) network integrity, Article 3(3)(e) personal data and privacy, and Article 3(3)(f) fraud prevention — the three cybersecurity pillars of the Radio Equipment Directive. It goes deep on EN 18031-1 (network security), EN 18031-2 (privacy protection), and EN 18031-3 (fraud prevention), including the restricted clauses that trigger mandatory Notified Body involvement. It covers secure-by-design principles, authentication and encryption requirements, OTA update architecture, vulnerability disclosure policies, and post-market obligations. A dedicated module covers the UK PSTI Act 2022 and US FCC Cyber Trust Mark as comparators, and a full CRA transition module maps what RED-compliant products need to add for December 2027. Built on Krono's regulatory database — the same data that powers our free compliance roadmap tool for hardware startups across FCC, CE/EU, UL, CSA, and global markets. This course contains the use of artificial intelligence for asthetic purposes. * Includes the ebook edition, free * 7 downloadable resources included ## What you'll learn * Identify which restricted clauses trigger mandatory Notified Body involvement — and choose your conformity route * Implement secure authentication, encrypted communications, OTA updates, and vulnerability disclosure mechanisms * Build a complete RED cybersecurity technical documentation file and Declaration of Conformity * Manage post-market obligations — incident reporting, product changes, and re-assessment * Prepare your product for the CRA transition deadline of 11 December 2027 * Compare EU RED requirements against UK PSTI Act 2022 and US FCC Cyber Trust Mark * Run a threat model for a connected product from first principles * Diagnose and fix the most common cybersecurity compliance failures * Build a realistic compliance budget and timeline for your connected product ## Requirements * ·Basic electronics or firmware engineering background * ·No prior cybersecurity regulatory knowledge required * ·Familiarity with how IoT or connected devices work is helpful but not essential $149.00 One-time purchase · Lifetime access · No subscription Less than one hour with a compliance consultant. [First lesson free to preview: The Shift from Voluntary to Legally Required](#lesson-335429e7-75d1-4416-b6c4-0f5fb511489d) * Understand why EU RED cybersecurity requirements are now commercially and legally mandatory for connected electronics * Determine whether your product falls under Article 3(3)(d), (e), or (f) — and what each requires * Apply EN 18031-1, EN 18031-2, and EN 18031-3 to real product designs Includes the ebook edition, free — read it in your [library](/platform/books) after purchase. Enroll — $149.00 Secure checkout via Paddle Not what you expected? Contact us within 14 days. Built from a regulatory graph already at work 1,368 users this week 658 guides 323 product types 9 markets ## Course content 19 modules·169 min total Introduction — Why Cybersecurity Compliance Is Now Mandatory Preview8 min The EU Regulatory Architecture 9 min Which Products Are In Scope 7 min EN 18031-1 — Network Security Requirements 11 min EN 18031-2 — Privacy and Personal Data Protection 9 min EN 18031-3 — Fraud Prevention and Secure Updates 9 min Conformity Assessment — Self-Declaration vs Notified Body 8 min Technical Implementation — Authentication and Access Control 9 min Technical Implementation — Encryption and Communications Security 10 min Technical Implementation — Updates and Vulnerability Disclosure 10 min Building Your Technical Documentation File 11 min Post-Market Obligations and Product Changes 8 min The Cyber Resilience Act — Preparing for December 2027 11 min UK PSTI and US Cyber Trust Mark — Market Comparison 8 min Working with Notified Bodies 8 min Secure by Design — Building Compliance In from Day One 10 min Common Compliance Failures and How to Fix Them 11 min Action Plan and Summary 10 min What's Next 0 min Enroll — $149.00 Need more than one? The **All-Access Krono Vault** unlocks every course and book for one payment, or put your whole team on it with **Krono Team Vault**. [See pricing](/pricing) Short on time? ### Rather hand it over than learn it? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. [See services](/services) ## You might also need [ ![FCC Certification Course for Hardware Startups](/posters/02-fcc-authorization-for-hardware-startups.svg) ](/courses/02-fcc-authorization-for-hardware-startups) Beginner1h 59m [ ### FCC Certification Course for Hardware Startups ](/courses/02-fcc-authorization-for-hardware-startups) Get your device FCC approved: Part 15 rules, SDoC vs Certification, TCBs and test labs, pre-certified RF modules, FCC ID labeling and common test failures. $149.00[View course →](/courses/02-fcc-authorization-for-hardware-startups) [ ![CE Marking for IoT Devices: RED, CRA & EMC Course](/posters/03-ce-marking-for-iot-devices.svg) ](/courses/03-ce-marking-for-iot-devices) Beginner3h 3m [ ### CE Marking for IoT Devices: RED, CRA & EMC Course ](/courses/03-ce-marking-for-iot-devices) CE marking for IoT and connected devices: the RED, EMC and LVD stack, RED cybersecurity, the Cyber Resilience Act, GPSR and the EU Declaration of Conformity. $149.00[View course →](/courses/03-ce-marking-for-iot-devices) [ ![UKCA Marking Course for Electronics Products](/posters/09-ukca-marking-for-electronics-products.svg) ](/courses/09-ukca-marking-for-electronics-products) Beginner2h 37m [ ### UKCA Marking Course for Electronics Products ](/courses/09-ukca-marking-for-electronics-products) Learn UKCA marking for electronics: which UK regulations apply, designated standards, conformity routes, the UK DoC and labelling rules for GB. $149.00[View course →](/courses/09-ukca-marking-for-electronics-products) [ ![FCC Cyber Trust Mark Course: IoT Security Labeling](/posters/12-fcc-cyber-trust-mark-iot-security.svg) ](/courses/12-fcc-cyber-trust-mark-iot-security) Intermediate1h 52m [ ### FCC Cyber Trust Mark Course: IoT Security Labeling ](/courses/12-fcc-cyber-trust-mark-iot-security) Earn the FCC Cyber Trust Mark for IoT devices: program scope, the NIST IR 8425 baseline, technical implementation, testing, labeling and a US security strategy. $149.00[View course →](/courses/12-fcc-cyber-trust-mark-iot-security) [ ![UK PSTI Act Compliance Course for IoT Products](/posters/18-uk-psti-act-iot-product-security-compliance.svg) ](/courses/18-uk-psti-act-iot-product-security-compliance) Intermediate2h 24m [ ### UK PSTI Act Compliance Course for IoT Products ](/courses/18-uk-psti-act-iot-product-security-compliance) Comply with the UK PSTI Act: scoping connectable products, the three security requirements, ETSI EN 303 645, support periods and the Statement of Compliance. $149.00[View course →](/courses/18-uk-psti-act-iot-product-security-compliance)