How To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
summary
EU CRA casts a wide net over software and open source by redefining roles like Manufacturer, Steward, Individual developer and by making concrete demands: report exploited vulnerabilities within 24/72/14 hours/days, produce SBOMs, and retain SBOMs and evidence for 10 years. Conformity uses self‑assessment for many products but requires third‑party assessment or EUCC for higher classes, and stewards can offer voluntary attestations. Practical tools and efforts already in motion include OpenSSF Security Insights YAML, GitHub advisories, scorecards and the ORC working group. Contributors with no commercial activity remain out of scope.
AI-written summary · about
chapters (16)
- 0:00EU Cyber Resilience Act intro
- 3:15CRA regulations and goals
- 7:36Roles and obligations
- 11:17Manufacturer compliance steps
- 15:23Conformity assessment process
- 18:57Standards in CRA compliance
- 21:26Open source stewards' duties
- 25:19Impact on open source contributors
- 26:43CRA timeline and deadlines
- 30:00Red Hat's industry role
- 31:48Community CRA support efforts
- 36:06Security attestations for projects
- 39:18CRA resources and education
- 40:22CRA benefits for security
- 42:08Key takeaways and steps
- 44:35Q&A: Deadlines and enforcement
related talks
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
32mThe EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting?
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
39mCherry Blossom and Compliance - An Intro To the EU CRA
44mThey're coming to regulate you!
33mImplementing the EU Cyber Resilience Act (CRA)
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know