ORC Monthly: Cyber Resilience Spec Project, Deliverables Plan and Feedback for the European Commission

The Cyber Resilience SIG reached a critical milestone by defining a scope of work for 2025. The Cyber Resilience Practices Spec project has also launched, with project proposal and feedback open for review and contribution. The Open Regulatory Compliance WG attended several recent industry events including Embedded World 2025.

Timo Perala and Dirk-Willem van Gulik
ORC co-chairs

What’s New

• Cyber Resilience Practices Specification project has been launched. This project aims to provide specifications to support the implementation of the CRA horizontal standards. You can review the proposal here.
• The Cyber Resilience SIG deliverables plan was approved, including scope and areas of prioritisation. Check it out and learn more about our activities and how to contribute: https://github.com/orcwg/orcwg/tree/main/cyber-resilience-sig
• At the 9th Cybersecurity Standardisation Conference on Thursday, March 20 ORC WG Senior Technical Lead Tobie Langel spoke at a panel called, “Overarching Cybersecurity by Standards.”
• Program Manager, Juan Rico, represented the ORC WG at Embedded World 2025. The Cyber Resilience Act was a hot topic in the embedded community with many organisations discussing their approach to compliance and voicing their concerns about the unanswered questions.

Top Conversations

• The Cyber Resilience Act requires the European Commission to specify the technical description of important and critical products with digital elements. Feedback is due by April 15, 2025. Join the discussion on ORC’s CRA Hub.
• Can a project be without a steward?
• Does a definition of a product category matter to a manufacturer or open source maintainer? The ORC WG is collecting feedback from the open source world and you can contribute via pull requests.

Overheard

Upcoming Events

CVE/FIRST VulnCon 2025 & Annual CNA Summit | April 7-10 - Collaborate with various vulnerability management and cybersecurity professionals to develop forward leaning ideas that can be taken back to individual programs for action to benefit the vulnerability management ecosystem.

• Marta Rybczynska and Mikael Barbero of the Eclipse Foundation will host a talk called, “Towards a Vulnerability Reporting Specification.” The talk can also be attended virtually for those not able to attend in-person. Register now.

Workshop: Cyber Resilience Act and the horizontal standard | April 8 - The workshop will provide a comprehensive understanding of how standards can effectively mitigate risks, enhance cybersecurity posture, and ensure that products and services are aligned with the legal expectations set forth by the Act.

• Tobie Langel will present at the workshop, which is available to attend online as well as in-person. Register now.

View all events

Recent Talks

• Recap from Victor Roland: A two-day panel on the Cyber Resilience Act (CRA)
• CRA ORC WG Workshop - 30 January
  • CRA Implementation for Open Source & How ORC Contributes to the Landscape
  • Anticipating the Cyber Resilience Act: The CCNL’s practical guide
  • ORC Workshop Wrap-up

Welcome ORC Members

The following members have joined in March 2025:

• Clever Cloud SAS
• Debian France
• Drupal Association
• Ferrous Systems GmbH

How to Participate

• Learn
• Contribute
• Join the Working Group