The Clock is Ticking: CRA Compliance at Scale
summary
Shows a large vendor mapping CRA deadlines into concrete workstreams: September 11 notifications and December 11 full compliance, with operational rules—24‑hour notification, 72‑hour confirmed impact, and 14‑day remediation notice—translated into tightened SDL controls, product identification, ESBOM/SBOM work, technical documentation and clarified support lifecycles. Details include supplier questionnaires, risk scoring of upstream OSS, use of OpenSSF tools like Scorecard and Sigstore/Salsa for build attestations, and experiments using AI to triage/fix upstream vulnerabilities or fork when maintainers don’t patch.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:27EU Cyber Resilience Act basics
- 4:16Dell’s CRA compliance work streams
- 7:50Technical documentation requirements
- 9:55Third-party risk management
- 14:13Open source security risks
- 16:20OpenSSF’s role in security
- 20:17OpenSSF tools for compliance
- 27:46Key takeaways
- 30:17Executive engagement for compliance
- 32:01Q&A
related talks
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
36mThe CRA roadmap: What to expect
01mConcerned about the CRA and how it impacts open source?
54mThe CRA, Where Are We Six Months After Its Approval
48mCRA, NIS2, DORA: What Senior Java Engineers Must Deliver Before 2027