From Inventory to Inspection: What the CRA Means for OSPO Maturity
summary
EU CRA forces continuous, build-time inventories and verifiable controls so organizations move from one-off SBOM snapshots to continuous observability across CI/CD. Implements include the scannos scanner feeding evidence into an OS dependency track instance, automated policy gates that block undeclared licenses or snippet matches, and a new focus on C-bombs (cryptographic inventories). Benchmarks cited: ~62% familiarity with CRA, ~28% invest in sustainability, ~1/3 have an OSS strategy — start integrating scans into pipelines now.
AI-written summary · about
chapters (9)
- 0:00OSPO and CRA impact
- 3:32Open source compliance challenges
- 7:03OSPO maturity in orgs
- 9:30CRA requirements and models
- 12:01Starting CRA journey
- 14:54Compliance in CI/CD
- 17:00Compliance automation tools
- 18:40CRA compliance principles
- 20:08Q&A
related talks
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
01mConcerned about the CRA and how it impacts open source?
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
27mBeyond Open Source Risks With the CRA and NIS2
30mFast, Lean, Precise, Controlled: Compliance Automation With OSCAL in Our Open-S...
36mSupplier Risk Where OSS Collides With Vendor Management
21mOur journey to CRA
23mSBOM adopatability in open source software scanning