Eclipse Foundation Project to tackle EU Cyber Resilience act compliance

The Eclipse Foundation has launched a new initiative to help businesses comply with the European Union’s Cyber Resilience Act (CRA).

 

 The project, named Open Source Compliance: Comprehensive Techniques and Essential Tools (OCCTET), aims to provide open-source tools and resources, particularly for small and medium-sized enterprises (SMEs), to meet the new EU cybersecurity rules.

 

The CRA, which became law in December 2024, introduces mandatory cybersecurity requirements for all digital products in the EU.

 

Non-compliance could lead to significant fines. A key challenge for businesses is the extensive use of open-source software (OSS), which can make up a large part of commercial products.

 

 OCCTET is designed to address this by offering a toolkit that includes a CRA compliance checklist, automated evaluation tools, and a collaborative database for sharing assessments of open-source components.

 

This open-source approach seeks to reduce the financial and technical burden of compliance. Mike Milinkovich, executive director of the Eclipse Foundation, noted that the project will also serve as a foundational framework for larger organisations.

 

The initiative highlights a broader shift towards proactive cyber resilience, a central theme of the CRA. The regulation requires manufacturers to build security into their products from the design phase, rather than treating it as an afterthought.

 

 It also mandates that companies must have processes to detect, manage, and report vulnerabilities, including notifying authorities of actively exploited flaws.

 

While the main obligations of the CRA come into effect in December 2027, the Eclipse Foundation’s project provides a timely solution, urging organisations to begin their compliance preparations now to strengthen their digital infrastructure and avoid future penalties.