[{"data":1,"prerenderedAt":338},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fblog\u002Fcra-monday-ecma-oswap":188,"sections:\u002Fblog\u002Fcra-monday-ecma-oswap":329,"feed:\u002Fblog\u002Fcra-monday-ecma-oswap":332,"breadcrumbs:\u002Fblog\u002Fcra-monday-ecma-oswap":333},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":190,"aliases":191,"author":192,"body":193,"breadcrumbTitle":191,"breadcrumbs":191,"date":322,"description":191,"extension":323,"featuredFooter":191,"keywords":191,"meta":324,"navigation":92,"path":325,"redirectUrl":191,"seo":326,"seoTitle":191,"socialImage":191,"stem":327,"summary":191,"typography":191,"visibility":191,"width":191,"__hash__":328},"blog\u002Fblog\u002Fcra-monday-ecma-oswap.md","Unlocking Software Supply Chain Security: Updates from Ecma TC54 and OWASP | CRA Mondays",null,"Juan Rico",{"type":194,"value":195,"toc":313},"minimark",[196,208,213,220,228,231,235,241,248,251,255,261,268,271,275,278,285,288,291,301,306],[197,198,199],"p",{},[200,201,202,203,207],"em",{},"This post is part of our CRA Mondays series. It captures a recent session featuring ",[204,205,206],"strong",{},"Samina Husain (Ecma International), Steve Spring (Chair of Ecma TC54), and Philippe Ombredanne (AboutCode)",", exploring the ongoing work in Ecma’s TC54 committee and its alignment with the EU’s Cyber Resilience Act (CRA).",[209,210,212],"h3",{"id":211},"spotlight-on-ecma-tc54","Spotlight on Ecma TC54",[197,214,215,216,219],{},"The session opened with ",[204,217,218],{},"Samina Husain",", Secretary General of Ecma International, introducing the history and role of Ecma in standardisation and its recent focus on the CRA. She explained how Ecma collaborated with OWASP to publish the CycloneDX specification as Ecma-424, highlighting the speed and efficiency of their process:",[221,222,223],"blockquote",{},[197,224,225],{},[200,226,227],{},"“We came together, did strong due diligence, and produced the CycloneDX standard very quickly.”",[197,229,230],{},"Samina emphasised the importance of ESBOMs (extended software bill of materials) for transparency and compliance and outlined how Ecma continues to expand work in areas such as package URLs, lifecycle events, and sustainability specifications.",[209,232,234],{"id":233},"software-and-system-transparency","Software and System Transparency",[197,236,237,240],{},[204,238,239],{},"Steve Spring"," provided a deep dive into TC54’s current and future initiatives. He described how TC54 draws inspiration from the success of TC-39 (the JavaScript standards committee), but applies it to transparency and supply chain security:",[221,242,243],{},[197,244,245],{},[200,246,247],{},"“TC54 is capable of delivering international standards with the rigor you’d expect — but at a much higher velocity.”",[197,249,250],{},"Steve explained the broad scope of CycloneDX, including upcoming 1.7 and 2.0 versions, which expand into sustainability, threat modeling, and behavior analysis. He highlighted the importance of preparing for future regulatory needs:",[209,252,254],{"id":253},"package-url-and-version-ranges","Package URL and Version Ranges",[197,256,257,260],{},[204,258,259],{},"Philippe Ombredanne"," focused on the Package URL (purl) and version range (vers) specifications, which are critical for accurately identifying and tracking software across ecosystems. He noted that adoption is accelerating:",[221,262,263],{},[197,264,265],{},[200,266,267],{},"“Support for PURL is being merged into the CVE schema at the same level as CPEs — this is huge for making vulnerabilities more actionable.”",[197,269,270],{},"Philippe also stressed the need for reliable tools and benchmarks to validate SBOMs and prevent inaccurate data from undermining supply chain security.",[209,272,274],{"id":273},"why-this-matters-for-cra","Why This Matters for CRA",[197,276,277],{},"The discussion reinforced how Ecma TC54’s work connects directly to CRA compliance. ESBOMs, lifecycle event tracking, and transparency APIs all help organisations meet regulatory requirements while fostering best practices in security and software development. As one participant put it:",[221,279,280],{},[197,281,282],{},[200,283,284],{},"“Transparency isn’t just about meeting regulations — it’s about building trust and resilience into the digital supply chain.”",[286,287],"hr",{},[197,289,290],{},"This presentation is valuable for anyone involved in compliance, open source governance, or cybersecurity. It illustrates how industry collaboration is shaping practical tools to meet the CRA’s ambitious goals.",[197,292,293,294,300],{},"See below for the video. Learn more about ORC and join the conversation: ",[295,296,29],"a",{"href":297,"rel":298},"https:\u002F\u002Forcwg.org",[299],"nofollow",".",[302,303,305],"h1",{"id":304},"watch-the-video","Watch the Video",[307,308],"youtube",{"description":309,"id":310,"title":311,"uploadDate":312},"At the heart of the EU Cyber Resilience Act (CRA) and other emerging EU regulations lies a critical focus on supply chain security and Software Bill of Materials (SBOM). Ecma TC54, in collaboration with OWASP, is advancing this agenda through its work on “Software and system transparency.”\nIn this session, you will gain insights into key initiatives shaping the future of software transparency—from OWASP CycloneDX to new efforts around software identifiers (PURL), Common Lifecycle Enumeration (CLE), and the Transparency Exchange API (TEA) for automating the delivery of transparency artefacts across the supply chain.\nThe session will also provide an overview of Ecma International’s role as a global standards organisation. A Q&A segment will give you the chance to engage directly with experts on these critical CRA-related standards.","NglPCEu4pok","CRA Mondays | Unlocking Software Supply Chain Security: Updates from Ecma TC54 and OWASP","2025-09-08",{"title":314,"searchDepth":315,"depth":315,"links":316},"",2,[317,319,320,321],{"id":211,"depth":318,"text":212},3,{"id":233,"depth":318,"text":234},{"id":253,"depth":318,"text":254},{"id":273,"depth":318,"text":274},"2025-09-10","md",{},"\u002Fblog\u002Fcra-monday-ecma-oswap",{"title":190},"blog\u002Fcra-monday-ecma-oswap","SW2c6eJSlHE8b5tobfeFQ-QWmlRJWyhtougb3DC1H60",[330],{"path":331,"visibility":191},"\u002Fblog",false,[334,337],{"path":335,"text":336},"\u002F","ORC",{"path":331,"text":109},1792684543434]