Beyond Open Source Risks With the CRA and NIS2
summary
EU CRA and NIS2 force supply‑chain risk assessments that treat open source as a distinct asset: expect issues like single maintainer risk, no contracts or liability, and license surprises. Recommended steps include inventorying dependencies, mapping licenses, scoring project maturity and frequency of incidents, and placing components in a 3x3 risk matrix to prioritize mitigations. Practical mitigations are support contracts, contributor agreements, funded maintenance or in‑house takeover; useful tools cited include OpenSSF Scorecard and CNCF monitors to automate some signals.
AI-written summary · about
chapters (8)
- 0:00Introduction and speakers
- 1:26Why this talk matters
- 4:59Open source risks in regulation
- 8:29Business continuity risks
- 11:18Risk management approach
- 14:06Open source risk categories
- 17:55Worst case scenarios
- 20:29Q&A and next steps
related talks
42mPanel Discussion: The Impact of the CRA on the Open Source Ecosystem
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
24mNavigating Open Source Project Risk
14mThe CRA: an Open Source Sustainability law?
25mOWASP Top 10 Risks for Open Source Software
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
24mThe CRA Challenge: Can Open Source and IoT Stay Agile Under Regulation?