Cyber Resilience Act: 36 Months to Prepare Your DevOps Pipelines
summary
The talk explains the EU Cyber Resilience Act requirements for commercial software that has any networked digital element: 36 months to meet full technical obligations, 21 months to begin incident declarations, and fines up to €15M or product removal. It details required artifacts and processes such as maintaining SBOMs for 5+ years, build provenance (SLSA/buildinfo), signed update pipelines (TUF/secure distribution), CVE tracking and remediation workflows, CI/CD scans, provenance records and audit trails, and third‑party certification for critical product categories.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:04EU’s reasons for CRA
- 4:53Who CRA affects
- 9:04CRA categories and requirements
- 11:11Administrative and technical requirements
- 13:16Technical implementation points
- 16:28Penalties and non-compliance risks
- 17:32DevOps automation for CRA
- 19:40Securing DevOps chain
- 27:03SBOM and vulnerability management
- 31:19Key takeaways
- 32:2336-month timeline and prep
- 34:55Q&A
related talks
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
22mEU Cyber Resilience Act - A Product Owner’s Approach
48mCRA, NIS2, DORA: What Senior Java Engineers Must Deliver Before 2027
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
16mCyber Resilience Act, already too late to comply?
44mThey're coming to regulate you!
32mThe EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting?
39mAll your code belongs to Policy Makers, Politicians and the Law