Hardware Podcasts

#024: Shipping Firmware Under the CRA: Nicolas Schieli on the Questions Everyone’s Asking, and the Ones They Should Be Link:

Coredump Sessions · 16 Sept 2026 · 1h 01m · Episode 25

What this episode covers

Nicolas Schieli, VP of Product Security at Nordic Semiconductor, joins François Baldassari and Chris Coleman to explain the EU Cyber Resilience Act (CRA) for connected products. They detail the immediate 24-hour vulnerability reporting requirements, the December 2027 compliance deadline, and the necessity of threat modeling, secure boot, and SBOMs. The discussion covers product classification, long-term support obligations, and how manufacturers remain responsible for their supply chain's security posture.

Most relevant to

large enterprises

Topics

Mentioned

Companies
Nordic Semiconductor, Memfault
Products
nRF Connect SDK, embed TLS
Also
Anisa, Zephyr, NIST, FreeRTOS

Related episodes from other shows

Other shows on the same ground, closest first.

  • IoT For All Podcast · 17m

    Navigating the Future of Embedded Computing | Toradex's Daniel Lang | Internet of Things Podcast

    Daniel Lang, Chief Marketing Officer at Toradex, discusses the evolution of embedded computing, focusing on the shift from Windows CE to Linux-based solutions and the integration of AI at the edge. He explains how Toradex’s Torizon platform addresses cybersecurity regulations like the EU Cyber Resilience Act (CRA) and FDA guidelines through secure over-the-air updates and vulnerability monitoring. Lang highlights trends in tiny ML, predictive maintenance, and the increasing importance of security in critical infrastructure sectors like power and industrial manufacturing.

    Embedded firmwareSecurity & privacy
    6 chapters

  • IoT For All Podcast · 18m

    What is Device Lifecycle Management? | Northern.tech's Eystein Stenberg | Internet of Things Podcast

    Eystein Stenberg, CTO and co-founder of Northern.tech, explains that device lifecycle management (DLM) is essential for OEMs transitioning to software-driven business models. He details the five stages of DLM—design, manufacture, commissioning, maintenance, and decommissioning—and argues that over-the-air (OTA) updates via tools like Mender are foundational for security and regulatory compliance, particularly under the EU Cyber Resilience Act. Stenberg highlights risks such as security vulnerabilities and fleet-breaking updates, while citing ZF Group as a customer leveraging Mender for autonomous vehicle management.

    Connected products & IoTSecurity & privacy
    10 chapters

  • IoT For All Podcast · 17m

    How to Succeed with IoT Software | Northern.tech's Eystein Stenberg | Internet of Things Podcast

    Eystein Stenberg, CTO and co-founder of Northern.tech, discusses the increasing dominance of software in IoT product development and the resulting time-to-market pressures. He highlights that software is now the primary differentiator and source of launch delays, with AI adding complexity to device lifecycle management. Stenberg advises OEMs to make explicit build-versus-buy decisions regarding infrastructure, such as Mender for OTA updates, to avoid technical debt and ensure compliance with regulations like the EU Cyber Resilience Act.

    Connected products & IoTAI & machine learning
    6 chapters

  • EMS@C-LEVEL · 12m

    BONUS - What's the SCOOP - 2022 Trends with Jürgen Thurner

    Jürgen Thurner, Principal Consultant at xpts4xlnc, outlines three critical trends for the electronics manufacturing industry in 2022: the persistence of supply chain bottlenecks due to a potential bullwhip effect, the regulatory pressure of the German Supply Chain Act and European Green Deal, and the rise of Cybercrime as a Service (CCaaS). Thurner warns that while component shortages may ease, over-ordering for safety stocks will create volatility, and companies must urgently address sustainability metrics and ransomware vulnerabilities.

    Sourcing & supply chainSustainability & circular products
    7 chapters

  • Global Medical Device Podcast · 42m

    #407: Cybersecurity in MedTech: FDA Compliance, Patient Safety & the Hidden Risks You’re Missing

    Christian Espinosa, founder of Blue Goat Cyber, explains why medical device cybersecurity must be integrated from the requirements phase to ensure patient safety, citing real-world risks like skin burns from hacked acne lasers and missed sepsis diagnoses. He details the FDA's September 2023 regulatory overhaul, which mandates Software Bill of Materials (SBOMs), static/dynamic testing, and risk assessments tied to patient harm, noting that traditional IT security vendors often fail to meet these specific medical device standards. Espinosa warns that waiting until the last minute to address security can lead to catastrophic delays, costly retrofits like disabling hardware features due to lack of secure boot support, or even abandoned projects.

    Security & privacyCertification & compliance
    8 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Coredump Sessions. The episode itself belongs to its publisher.