Zephyr: Evolving To CRA Readiness
summary
Zephyr claims concrete readiness steps for the CRA: automatic SBOM generation since 2022, five‑year LTS support, CNA CVE authority since 2017, and a vulnerability registry with 30/60/90 cadence that pushes alerts to signed product registrants. SBOMs currently match NTIA minima and can be built per board at scale. Reporting deadlines start September 2026 and enforcement is 2027, so gaps are mainly EU SBOM format specifics, market surveillance federation, and precise CERT/CSIRT endpoints.
AI-written summary · about
chapters (5)
- 0:00Zephyr and CRA readiness
- 6:46Zephyr as CRA steward
- 15:11Zephyr security and LTS
- 23:00Manufacturer penalties under CRA
- 29:46Q&A on liability
related talks
40mZephyr: Evolving To CRA Readiness
29mLessons Learned on Following Security Best Practices in Zephyr
36mThe CRA roadmap: What to expect
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
16mDesigning Secure Systems for CRA Compliance leveraging Zephyr
40mZephyr Project Security Status
43mZephyr at 10 Years: Survey Feedback
43mZephyr Project: Results from Applying Open Source and Security Best Practices