CRA panel discussion + Q&A
summary
Panel identifies three concrete shortfalls: lack of an operational vulnerability handling process (Article 14 deadlines in September and formal handling expected by December), missing secure communication mechanisms with suppliers and users, and unclear product categorisation under CRA rules that affects testing paths. Demonstrations include OTA tooling using Amazon IoT to update over a million devices simultaneously; gaps around the EU single reporting platform versus MITRE/CVE and how “substantial modification” triggers re‑assessment also remain unresolved.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:04Manufacturers' CRA gaps
- 4:35CRA implementation challenges
- 8:44Audience concerns
- 13:57Retrospective CRA application
- 18:06Reporting platforms & vulnerabilities
- 21:35Software updates & support
- 26:49Beta features & CRA
- 32:07Q&A
related talks
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
30mThe EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...
22mEU Cyber Resilience Act - A Product Owner’s Approach
27m4 Panel Session - Bridging Policy and Practice
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
01h 18mEU CRA TL/DR for PSIRTS - What Product Security Needs To Do To Be Compliant with the CRA