How to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
summary
EU CRA applies beyond EU sellers to vendors, distributors and even projects that monetize code and creates mandatory duties like conformity assessment and SBOMs with reporting of exploited vulnerabilities from September 2026 and full applicability in December 2027. Practical paths include adopting the OpenSSF 56 controls OS security baseline, emitting a machine-readable security-insights YAML, joining ORC/Foundation tooling work, and treating maintainers who don’t monetize as generally out of scope.
AI-written summary · about
chapters (11)
- 0:00EU CRA introduction
- 3:58CRA regulation coverage
- 6:08CRA key requirements
- 8:16CRA timeline and enforcement
- 9:42Open source in CRA scope
- 13:39Open source contributor obligations
- 17:10Community CRA compliance efforts
- 20:02Open source security practices
- 23:36CRA compliance tools
- 25:52CRA takeaways and next steps
- 28:24Q&A on CRA
related talks
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
39mCherry Blossom and Compliance - An Intro To the EU CRA
22mEU Cyber Resilience Act - A Product Owner’s Approach
32mThe EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting?
33mImplementing the EU Cyber Resilience Act (CRA)