CIRP, the certification for critical infrastructure resilience.

CIRP, the Critical Infrastructure Resilience Professional certification, is Resilience Guard Academy's answer to the training obligation that now sits in European law: three professional tiers train the managers and assurance staff new to the regime, the implementers who build the programme, and the experienced professionals who carry the accountability, and the Workforce Awareness Programme builds awareness across everyone else.

The European cyber resilience landscape changed materially in 2023 and 2024. The NIS2 Directive imposes binding cybersecurity obligations on tens of thousands of essential and important entities across the European Union. The German BSI Act and the KRITIS regime extend that picture in Germany. The Swiss Information Security Act, in force since the beginning of 2024, places parallel obligations on the operators of Swiss critical infrastructure. DORA and the Critical Entities Resilience Directive complete the picture for financial entities and for physical resilience. Article 13 of the CER Directive (EU) 2022/2557 adds its own people requirements for critical entities: employee security management, with training requirements and qualifications for staff in critical functions, and awareness raising among relevant personnel.

Across these regimes one rule cuts through: training for the management body, and similar training for employees, is no longer good practice. It is the law. NIS2 Article 20(2) requires the members of management bodies to follow training, and in Germany the BSI Act makes personal liability explicit. For senior leaders, training is not a procurement item to be delegated. It is a personal compliance matter.

CIRP is independently mapped to six recognised frameworks: the ENISA European Cybersecurity Skills Framework, the ISC2 CISSP Common Body of Knowledge, the ISACA domains, the IAPP continuing privacy education scheme, the BCI Good Practice Guidelines Edition 7.0 and the DRI International Professional Practices. The mapping documents are available on request.

CIRP complements rather than replaces the established credentials. The established certifications are global and framework led; CIRP is built specifically around the European regulatory regime, by practitioners who advise on these obligations daily. Learning hours, 16 for Foundation, 24 for Advanced and 32 for Expert, each including eight hours of self paced study, may be self reported under each body's continuing development scheme. CIRP is not endorsed, approved or accredited by ENISA or by the European Union; the ECSF mapping is a legitimate use of the EU's own skills taxonomy with source attribution.

CIRP certifies the people who make a critical entity resilient and compliant. Sooner or later that resilience meets a real event, and the question changes from whether the programme satisfies the law to whether the leaders can run the crisis. ECL, the Executive Crisis Leader certification, answers that second question, and for many CIRP holders it is the natural next step.

The two schemes are one family, with shared governance, examination discipline and naming. Professional development hours count in both directions and there are no examination exemptions either way. The right ECL level depends on the role you hold now more than on your CIRP tier, and these are the usual entry points.