Apply now
Postgraduate DiplomaElectronics, Embedded Systems & Telecom Applications open

Diploma in Secure OTA, SBOM and Vulnerability Management

Online postgraduate diploma of 800 hours in secure OTA, SBOM and vulnerability management. 8 modules covering the regulatory framework, secure OTA architectures, campaign operation, SBOM, vulnerability management, disclosure and supply-chain security with the Cyber Resilience Act, UNECE R155 and UNECE R156, with an assigned technical tutor.

Duration800 hours · 6–8 months
ModeOnline
LanguageEnglish
Start datesSet by the faculty
AwardSEIUM Institute diploma
Enrol now View syllabus Ask an advisor
Virtual lab · try it before you enrol

Take the controls.

Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.

SIM · LIVE ●
Learning outcomes

What you will be able to do

01

Interpret the obligations of the CRA and UNECE R155 and R156 regarding updates.

02

Design secure OTA architectures based on TUF and Uptane.

03

Operate large-scale update campaigns.

04

Generate and maintain SBOMs in SPDX and CycloneDX formats.

05

Prioritise vulnerabilities with CVSS, EPSS and VEX.

06

Manage coordinated disclosure and incident response.

07

Protect the software supply chain.

Profile

Who it's for

  • Product security engineers facing CRA and UNECE obligations.
  • PSIRT leads organising vulnerability handling and disclosure.
  • OTA update engineers designing and operating campaigns.
  • Vulnerability analysts working with SBOM, CVSS and VEX.
  • DevSecOps engineers securing build pipelines.
  • CRA compliance managers preparing manufacturer documentation.
  • Engineering or science graduates looking to enter the automotive sector.
Standards & tools

What you'll work with

  • Regulation (EU) 2024/2847 (Cyber Resilience Act) (cybersecurity requirements for products with digital elements)
  • UN Regulation No. 155 (UNECE R155) (vehicle cybersecurity management system)
  • UN Regulation No. 156 (UNECE R156) (vehicle software update management system)
  • ISO 24089:2023 (road vehicles software update engineering)
  • ISO/IEC 5962:2021 (SPDX) (software package data exchange)
  • ECMA-424 (CycloneDX) (bill of materials specification)
  • ISO/IEC 29147:2018 (vulnerability disclosure)
  • ISO/IEC 30111:2019 (vulnerability handling processes)
  • Syft
  • Grype
  • Dependency-Track
  • Eclipse hawkBit
  • Mender
Syllabus

8 modules

  1. 1.1Cyber Resilience Act and manufacturer obligations
  2. 1.2UNECE R155 and the CSMS
  3. 1.3UNECE R156 and the SUMS
  4. 1.4ISO 24089 for software updates
  5. 1.5Mandatory reporting of exploited vulnerabilities
  6. 1.6Support period and end of life
  7. 1.7FDA requirements for medical devices
  8. 1.8NIS2 Directive and suppliers
  9. 1.9Evidence for type approval
  10. 1.10Case study: gap analysis of a manufacturer against the CRA
  1. 2.1Push and pull update models
  2. 2.2Uptane framework for automotive
  3. 2.3The Update Framework (TUF)
  4. 2.4Roles, metadata and delegations
  5. 2.5Protection against freeze and mix-and-match attacks
  6. 2.6Secure channel and mutual authentication
  7. 2.7Delta updates and compression
  8. 2.8Coordinated update of multiple ECUs
  9. 2.9Recovery from update failures
  10. 2.10Lab: TUF repository with separate roles
  1. 3.1hawkBit and Mender servers
  2. 3.2Fleet segmentation and canary deployment
  3. 3.3Maintenance windows and consent
  4. 3.4Monitoring success rates
  5. 3.5Telemetry and device status
  6. 3.6Scaling to millions of devices
  7. 3.7Data and connectivity costs
  8. 3.8Incident management in campaigns
  9. 3.9OTA performance indicators
  10. 3.10Practical exercise: staged campaign with hawkBit
  1. 4.1Minimum elements according to the NTIA
  2. 4.2SPDX and CycloneDX formats
  3. 4.3SBOM generation at build time
  4. 4.4SBOM for firmware and binaries
  5. 4.5PURL and CPE identifiers
  6. 4.6Transitive dependencies and vendoring
  7. 4.7SBOM in Yocto and Zephyr
  8. 4.8Signing and distribution of the SBOM
  9. 4.9Inventory quality and completeness
  10. 4.10Workshop: CycloneDX SBOM with Syft
  1. 5.1Sources: NVD, OSV and vendor advisories
  2. 5.2CVSS 4.0 and EPSS scoring
  3. 5.3CISA KEV catalogue
  4. 5.4VEX to communicate exploitability
  5. 5.5Correlation between SBOM and vulnerabilities
  6. 5.6Risk-based prioritisation
  7. 5.7Management with Dependency-Track
  8. 5.8Patches, backports and mitigations
  9. 5.9Time-to-remediation metrics
  10. 5.10Lab: vulnerability analysis with Dependency-Track
  1. 6.1Disclosure according to ISO/IEC 29147
  2. 6.2Internal handling according to ISO/IEC 30111
  3. 6.3The PSIRT and its organisation
  4. 6.4Bug bounty programmes
  5. 6.5Notification to ENISA under the CRA
  6. 6.6Security advisories in CSAF format
  7. 6.7Coordination with national CERTs
  8. 6.8Communication with customers
  9. 6.9Lessons learned and improvement
  10. 6.10Case study: handling a critical vulnerability
  1. 7.1SLSA framework and its levels
  2. 7.2Artefact signing with Sigstore
  3. 7.3Reproducible and verifiable builds
  4. 7.4Protecting the CI/CD pipeline
  5. 7.5Third-party components and licences
  6. 7.6Supplier assessment
  7. 7.7Provenance attestations with in-toto
  8. 7.8Build secrets management
  9. 7.9Dependency auditing
  10. 7.10Practical exercise: artefact signing with cosign
  1. 8.1Analysis of regulatory requirements
  2. 8.2Product OTA architecture
  3. 8.3SBOM generation and management
  4. 8.4Vulnerability management process
  5. 8.5Response plan and reporting
  6. 8.6Simulated update campaign
  7. 8.7Indicators and dashboard
  8. 8.8Regulatory compliance documentation
  9. 8.9Report and presentation
  10. 8.10Final project: final review with the tutor
Methodology, software & labs

How you'll learn

100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: you progress at your own pace within the intake, so it can be combined with work.

Each module combines theory, guided reading of the original standard and applied exercises. The working software is Syft, Grype, Dependency-Track, Eclipse hawkBit and Mender, in free, academic or evaluation versions. Testing is studied on real procedures: SBOM generation in build pipelines, staged update campaigns and vulnerability triage with VEX. Assessment is continuous by module plus the final project.

Standards covered: Regulation (EU) 2024/2847 (Cyber Resilience Act), UN Regulation No. 155 (UNECE R155), UN Regulation No. 156 (UNECE R156), ISO 24089:2023, ISO/IEC 5962:2021 (SPDX), ECMA-424 (CycloneDX), ISO/IEC 29147:2018, ISO/IEC 30111:2019.

Assigned technical tutor:every module ends with a deliverable that your tutor marks individually.
Standards-based learning:guided reading of the Cyber Resilience Act, UNECE R155 and UNECE R156 applied to real cases, not as a theoretical annex.
Industry software:Syft, Grype, Dependency-Track, Eclipse hawkBit and Mender, in free, academic or evaluation versions.
Final project:a complete OTA and vulnerability management system for a product, with SBOM, vulnerability process, response plan and a simulated update campaign, reviewed by your tutor.
Flexible format:100% online, no fixed timetables, compatible with full-time work.
Capstone project

Build it end to end

Your final project follows the real engineering workflow, step by step, reviewed by your tutor.

Analyse regulation
Run a gap analysis against the CRA and UNECE R155/R156.
Design the OTA architecture
Build a TUF/Uptane-based update architecture with separate roles.
Generate SBOM and triage
Produce a CycloneDX SBOM with Syft and triage vulnerabilities in Dependency-Track.
Run an update campaign
Execute a staged campaign with hawkBit and track indicators on a dashboard.
Final project
A complete OTA and vulnerability management system, from regulatory analysis to compliance documentation, reviewed by your tutor.
Career opportunities

Where this takes you

Product security engineerPSIRT leadOTA update engineerVulnerability analystDevSecOps engineerCRA compliance manager
Admissions & scholarships

Requirements

  • Prior technical training or professional experience in the sector. No university degree is required.
  • Internet connection and a computer able to run the programme software.
  • English sufficient to read technical standards.

Ready to start?

Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.

Apply now Scholarships
FAQ

Frequently asked questions

The programme totals 800 hours over 6–8 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.

You work with Syft, Grype, Dependency-Track, Eclipse hawkBit and Mender, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.

A SEIUM Institute diploma, awarded on passing the continuous assessment and the final project. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.

Yes. Modules passed are recognised in a higher programme in the same area (postgraduate diploma or master's). Ask about the recognition policy when you enrol.

Prior technical training or professional experience in the sector (no university degree required), a computer able to run the software and English sufficient to read technical standards.

Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.

Keep exploring

Related programmes

See all in Electronics, Embedded Systems & Telecom
Postgraduate Diploma2,000 $

Postgraduate Diploma in Low-Power Telemetry and Protocols

Online Postgraduate Diploma of 800 h in Low-Power Telemetry and Protocols. 8 modules covering LoRaWAN L2 1.0.4 (TS001), IEEE 802.15.4 and the Nordic Power Profiler Kit…

800 hOnlineElectronics, Embedded Systems & Telecom
Postgraduate Diploma1,670 $

Postgraduate Diploma in Network Latency Validation

Online Postgraduate Diploma in Network Latency Validation, 800 h. 8 modules with IETF RFC 2544, IETF RFC 7679 and iperf3. Assigned tutor and open enrolment.

800 hOnlineElectronics, Embedded Systems & Telecom
Postgraduate Diploma1,440 $

Diploma in Applied Cryptography and Anti-rollback

Online postgraduate diploma of 800 hours in applied cryptography and anti-rollback. 8 modules covering cryptographic primitives, embedded cryptography, key management and PKI, firmware signing, anti-rollback protection,…

800 hours · 6–8 monthsOnlineElectronics, Embedded Systems & Telecom
Diploma in Secure OTA, SBOM and Vulnerability ManagementEnrol
Related programmes

More in Electronics, Embedded Systems & Telecom

Diploma in Network Code ComplianceView programme →Postgraduate Diploma in AUTOSAR Integration and RTEView programme →Postgraduate Diploma in DO-160/DO-254 and Test PlansView programme →Postgraduate Diploma in LoRaWAN: Design and OperationView programme →Diploma in CISPR/IEC Testing and Pre-ComplianceView programme →TSN Diploma on Industrial EthernetView programme →

All Electronics, Embedded Systems & Telecom programmes → · How to apply · Fees & financing · Scholarships

Scroll to Top
SEIUM – Institute of Advanced Engineering
Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.