From the webWorth reading elsewhere, with our take
Your enterprise doesn’t need six BOM programs. It needs one evidence graph (opens CSO Online)
CSO Online ·
CRA compliance drives continuous security testing (opens qa-financial)
qa-financial ·
What’s in the SOSS? Podcast #75 – S3E27 From Upstream to Downstream: Managing Open Source Risk in a Changing Regulatory Era with Vincent Danen (opens OpenSSF)
OpenSSF ·
Tech suppliers need to pass new security baseline down the supply chain (opens Pinsent Masons)
Pinsent Masons ·
A Decade of Industrial Grade Linux: How the Civil Infrastructure Platform Is Securing Mission-Critical Systems (opens Linux Foundation)
Linux Foundation ·
OpenSSF Shares Expanded Membership and New Global Policy Resources During Community Day Europe (opens OpenSSF)
OpenSSF ·
QNAP Adds CRA Reporting Process for Actively Exploited Flaws and Major Incidents (opens iPhone)
iPhone ·
The EU Cyber Resilience Act and SBOMs: Why Embedded Software Teams Need a Different Approach (opens Security Boulevard)
Security Boulevard ·
An opinion piece arguing that embedded software teams cannot approach SBOMs the way server-side teams do, and need a different approach to CRA readiness.
Code & Compliance 2026 Programme Is Now Live (opens Eclipse Foundation)
Eclipse Foundation ·
A one-day programme in Brussels on 27 October on building compliant products under the CRA and the AI Act, and on how manufacturers and the open source ecosystem can work together.
CRA Tech Talk, 09/07/2026 (opens OpenSSF)
OpenSSF ·
Recording-style agenda from the OpenSSF policy group: an intro to the reporting obligations plus readiness stories from SUSE, Nokia and the Linux Foundation. Worth a look to see how large vendors are approaching the reporting process in practice.
The Vulnerability Was Real; The Exploit Was Impossible; The EU Cyber Resilience Act Reporting Obligation Was … Unclear? (opens JD Supra)
JD Supra ·
EU Cyber Resilience Act: Vulnerability and incident reporting obligations now apply and ENISA’s Single Reporting Platform is live (opens JD Supra)
JD Supra ·
Crypto wallet creators now have just 24 hours to alert regulators when flaws are exploited (opens CryptoSlate)
CryptoSlate ·
Meeting the CRA's 2026 Reporting Requirements (opens FOSSA)
FOSSA ·
Eclipse Foundation Releases Free Toolkit to Help SMEs Prepare for the EU Cyber Resilience Act (opens Eclipse Foundation)
Eclipse Foundation ·
The Eclipse Foundation has released a free, open source toolkit, built through the EU-funded OCCTET project, to help small and medium-sized enterprises prepare for the CRA. A practical starting point for smaller manufacturers.
How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act (opens Linux Foundation)
Linux Foundation ·
The Linux Foundation frames 11 September 2026 as the date reporting obligations bite: be ready to assess actively exploited vulnerabilities and severe incidents, coordinate a response, and notify on time. Useful as a checklist of what an OSPO-led readiness effort covers.
CRA Product Classification Explained: Default, Important, and Critical (opens FOSSA)
FOSSA ·
A reference on how the Act sorts products into Default, Important (Class I and II) and Critical, with the Annex III and IV lists. The tier determines whether you can self-assess or need a third-party conformity assessment before CE marking.