With the recent publication of the EU’s Cyber Resilience Act (CRA) in the EU official journal, a 3 year race now begins for compliance by the global technology industry. This legislation sets new cybersecurity requirements that manufacturers and the open source projects they rely upon must meet. The open source community via the Open Regulatory Compliance (ORC) Working Group, is working with numerous open source foundations, SMEs, and industry to establish processes to comply with this new regulatory landscape.
The Race to Compliance
The CRA defines clear targets and timelines, marking the start of a sustained compliance journey. This effort will require time, energy, and resources and the ORC Working Group is here to support the open source ecosystem. Our mission is to guide open source participants and adopters in aligning with CRA requirements through practical frameworks and expertise to support their regulatory journey from start to finish.
How the ORC Working Group Supports Open Source Compliance
The many foundations and other stakeholders which are members of the ORC Working Group are dedicated to guiding the open source community toward successful CRA compliance. Through active community engagement, we’re creating practical resources and adaptable frameworks that empower projects to meet regulatory standards, while preserving open source values. As a community, we have identified the following 4 pillars to guide this effort:
- Bridging the Knowledge Gap: The ORC Working Group prioritises education and training to empower the community with tools to adopt compliant development practices. By creating resources, like cyber resilience guidelines for example, and continuously updating them to align with emerging regulations, we simplify CRA compliance for open source maintainers, projects, communities, and foundations.
- Establishing Compliance Frameworks: We’re defining best practices, processes, and tools that can be translated into specifications addressing regulatory needs. These frameworks prioritise security and compliance for open source projects. Additionally, we will work with standardisation bodies to ensure that open source perspectives help shape global regulatory standards.
- Institutional Engagement: Collaboration with regulatory authorities is central to effective compliance. The ORC Working Group is committed to engaging with these institutions, gathering feedback, and supporting the adoption of community-driven compliance frameworks. This ensures our work aligns with both industry standards and regulatory expectations.
- Strengthening Community Support: Community engagement drives this effort. Through events, workshops, and comprehensive documentation, we keep members informed and prepared for CRA compliance. In the coming months, the ORC will launch additional guidance initiatives to ensure that the open source community is supported every step of the way.
Ultimately, the CRA provides the community and industry an opportunity to deliver more secure products while making open source more sustainable. It will be a new challenge for our community. However, by working together on practices and standards to facilitate compliance we will achieve its laudable goal: making the digital products that are so prevalent in our lives more secure.
Join the Effort
Joining ORC is your opportunity to contribute directly to a compliance strategy that not only upholds cybersecurity requirements but also supports ongoing open source innovation. Early involvement with the ORC Working Group offers a chance to contribute to the foundational compliance framework that will guide our community and influence how standards are implemented industry-wide. Join us in shaping how the CRA is implemented to set the open source community up for success under these new regulations.
