The Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
summary
The Cyber Resilience Act makes mandatory a product-level security risk assessment that drives design, testing and maintenance, imposes 72-hour reporting for incidents and vulnerabilities, and requires vulnerability management with 5-year minimum support and large fines on par with GDPR. Yocto workflows must produce precise SBOMs (SPDX), use CVE tooling (CVCheck) and secure update paths; a raw Yocto scan can list ~5,000 hits that a kernel-config–aware filter reduces to about ~200 actionable CVEs for triage. Timeline: staged enforcement reaches full effect in 36 months.
AI-written summary · about
chapters (9)
- 0:00Cyber Resilience Act intro
- 1:32Origins of the CRA
- 7:13Regulatory framework
- 10:48Five CRA requirements
- 14:19Security risk assessment
- 25:22Vulnerability management
- 36:00Secure Yocto platforming
- 41:43Timeline and compliance
- 44:10Q&A on CVE databases
related talks
53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
33mImplementing the EU Cyber Resilience Act (CRA)
35mDetecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
34mYocto Project/OpenEmbedded Meets Security
42mComparison and Proposal of Vulnerability Management Approaches in Yocto-Based...
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
15mKeynote: Cutting Through the Fog: Clarifying CRA Compliance in Cloud Native
46mLinux Foundation Initiatives Supporting the Implementation of the EU Cyber Resilience Act