Your CRA Journey With OCCTET: A Map for SMEs and Open Source Projects

Reference Installation
Secure FOSS Development
Open Source Stewards
Checklists & Templates
OCCTET · Open Source Compliance Toolkit
A map of OCCTET results for SMEs and open source projects, from the first question about the Cyber Resilience Act to compliance that lasts.
Not sure where to start with the CRA?
Your obligations depend on what you do with open source. Pick the profile that fits you best.
Pain point: Due diligence on every open source component you ship, with a small team and no compliance department.
You place the product on the EU market, so its CRA obligations, including the open source inside, are yours.
Pain point: Security questionnaires from every downstream user, and uncertainty about what the CRA expects from you.
The CRA does not regulate open source development as such, but your practices shape how downstream users manage risk.
Pain point: Do we qualify as a steward, and what exactly must we put in place?
Stewards have tailored obligations focused on policy, coordination and transparency, not those of manufacturers.
Questions along the way?
The Open Regulatory Compliance (ORC) working group, hosted by the Eclipse Foundation, maintains a CRA FAQ organised by audience and topic. It also gathers the European Commission's official FAQs and guidance, and ENISA's answers on vulnerability reporting.
Six steps that scale with the criticality of your product and the resources you have. Each one points to the OCCTET results that help.
Does the CRA apply to my product, and what does it require?
Pain point: Regulatory fog. Roles, obligations and deadlines are hard to read, and there is no compliance team to decode them.
48 companies from 22 countries assessed themselves: average maturity 1.66 / 3, with risk management and governance the weakest domain (1.11).
Where do we stand today, and which gaps matter most?
Pain point: No baseline. Security work exists but is rarely structured or documented.
Which open source components are inside our product?
Pain point: Invisible dependencies. Incomplete SBOMs and unknown transitive components.
Which components deserve closer scrutiny?
Pain point: Uniform checks waste effort, while critical, internet-facing components get too little attention.
How do we handle vulnerabilities and show our work?
Pain point: Patches are applied, but decisions and evidence are not recorded for the technical documentation.
How do we stay compliant over the whole product lifetime?
Pain point: One-off efforts decay. Vulnerabilities surface years after release and maintainers move on.
CRA-ready, and staying ready
Compliance is continuous. Reassess when your product, its exposure or its dependencies change.
Understand the regulation and the practices behind it.
Watch the recordings of OCCTET webinars and CRA Mondays talks, from the CRA basics to SBOMs and the toolkit.
Free and open source tools to analyse, curate and report.
Learn with peers and help shape the results.
Open source tools, shared knowledge, CRA-ready SMEs.
OCCTET project has received funding from the Digital Europe Programme (DIGITAL), under grant agreement number: 101190474. The content does not necessarily reflect the views of the European Commission. The European Commission is not liable for any use that may be made of the information contained herein.
Print or save as PDF