Merging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
summary
The EU Cyber Resilience Act creates legal duties mainly for manufacturers selling “products with digital elements,” shifts liability downstream (maintainers are largely exempt), and ties vulnerability rules to strict timelines — 24 hours notification for exploited issues, 72 hours advisory and a month for postmortem — with fines up to 2–2.5% global turnover. A practical response is adoption of the OpenSSF baseline (a catalog of 41 requirements with three maturity levels), use of SBOMs/in-toto/OSV tooling, and closer funding or collaboration with stewards.
AI-written summary · about
chapters (11)
- 0:00Security compliance basics
- 3:37EU Cyber Resilience Act impact
- 6:26CRA legal liability
- 10:59Security and compliance frameworks
- 14:14Open source vulnerability management
- 24:47Open Source Security Baseline
- 33:13CRA compliance resources
- 36:45CRA non-compliance penalties
- 41:25CRA product classes
- 49:57Security compliance collaboration
- 53:50Q&A
related talks
44mThey're coming to regulate you!
46mLinux Foundation Initiatives Supporting the Implementation of the EU Cyber Resilience Act
27m4 Panel Session - Bridging Policy and Practice
39mAll your code belongs to Policy Makers, Politicians and the Law
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)