Sponsored Session: Who Will Move Your Cheese ? IEC, CRA, Cyber Security
summary
European CRA effective Dec 11 2027 forces manufacturers to report and fix vulnerabilities fast, with fines up to €15M or 2.5% of global turnover; product lifecycles require minimum five years of support and over‑the‑air fixes. Expect Linux to produce 50+ CVEs/week, typical sbom to list ~2.5k components, and 96% of product software to be open source. Practical tooling and standards mentioned: sbom, CVE 24‑hour reporting, IEC 62443, CIP, Zephyr, ThreadX, YTO, and an upstream‑first development model.
AI-written summary · about
chapters (8)
- 0:00Cyber security compliance changes
- 4:01Cyber Resilience Act impact
- 7:11Vulnerability reporting lifecycle
- 11:06Where vulnerabilities hide
- 15:24Cyber security standards design
- 16:52Stakeholder roles responsibilities
- 19:18TI approach to IEC compliance
- 26:04Community collaboration next steps
related talks
44mThey're coming to regulate you!
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
15mKeynote: Cutting Through the Fog: Clarifying CRA Compliance in Cloud Native
22mEU Cyber Resilience Act - A Product Owner’s Approach
46mLinux Foundation Initiatives Supporting the Implementation of the EU Cyber Resilience Act
33mImplementing the EU Cyber Resilience Act (CRA)
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
30mThe EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...