Panel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
Panelat Open Source Summit Europe 2025 · on Monday, 2025-08-25· at 16:30· Elicium 2A (Elicium Level 1)·
summary
CRA deadline 2027 and most organisations remain unready; the Act treats companies that ship software as manufacturers and keeps maintainers largely out of strict obligations. Practical takeaways: use Scorecard, Baseline, SBOMs and VEX for self‑attestation, integrate with LFX, enable MFA, and automate control checks. A control catalog and Baseline-based work reduced gaps for one project to 19 of 21 controls covered, but legal uncertainty and CVE triage remain unresolved.
AI-written summary · about
chapters (10)
- 0:00Panel introduction and CRA overview
- 3:55Key actors under CRA
- 7:49Stewards and foundations in compliance
- 10:37Linux Foundation's CRA support
- 14:32OpenSSF baseline controls
- 20:54Global CRA perspectives
- 23:20CRA challenges for maintainers
- 29:04Desired outcomes post-CRA
- 35:41Baseline project Q&A
- 40:59Closing remarks
related talks
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
01mConcerned about the CRA and how it impacts open source?
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
15mKeynote: Cutting Through the Fog: Clarifying CRA Compliance in Cloud Native
33mImplementing the EU Cyber Resilience Act (CRA)
24mThe CRA Challenge: Can Open Source and IoT Stay Agile Under Regulation?