[{"data":1,"prerenderedAt":264},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fblog\u002Fcra-monday-roger-riera":188,"sections:\u002Fblog\u002Fcra-monday-roger-riera":255,"feed:\u002Fblog\u002Fcra-monday-roger-riera":258,"breadcrumbs:\u002Fblog\u002Fcra-monday-roger-riera":259},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":190,"aliases":191,"author":192,"body":193,"breadcrumbTitle":191,"breadcrumbs":191,"date":248,"description":191,"extension":249,"featuredFooter":191,"keywords":191,"meta":250,"navigation":92,"path":251,"redirectUrl":191,"seo":252,"seoTitle":191,"socialImage":191,"stem":253,"summary":191,"typography":191,"visibility":191,"width":191,"__hash__":254},"blog\u002Fblog\u002Fcra-monday-roger-riera.md","Demystifying \"simplified CC for CRA\" | CRA Mondays",null,"Shanda Giacomoni",{"type":194,"value":195,"toc":244},"minimark",[196,210,217,220,223,226,229,232,237],[197,198,199,200,204,205,209],"p",{},"The latest CRA Monday featured ",[201,202,203],"strong",{},"Roger Riera",", a technical manager at Applus+ Laboratories and Type A member of the European Commission’s Cyber Resilience Act (CRA) Expert Group. Roger introduced his work on a new methodology called the ",[206,207,208],"em",{},"Simplified Common Criteria for CRA",", or sCC4CRA**,** a practical framework designed to help manufacturers perform self-assessments under the CRA.",[197,211,212,213,216],{},"Roger began by explaining how the CRA allows manufacturers of “default” products to self-assess compliance through Module A of the New Legislative Framework. The goal, he said, was to translate the rigour of ",[206,214,215],{},"Common Criteria (CC)"," into a more accessible, self-contained model that could support conformity with CRA requirements — without the heavy formality that often makes CC certification intimidating.",[197,218,219],{},"“Common Criteria isn’t the problem,” Roger noted. “It’s a mature, logical methodology — we just need to adapt its language and process to make it usable under the CRA.”",[197,221,222],{},"The sCC4CRA methodology mirrors the familiar structure of Common Criteria but uses plain, CRA-aligned terminology and concepts. It includes both a high-level overview and a detailed step-by-step playbook, hosted publicly on GitHub to allow community feedback and version control. Each chapter aligns with the key elements of CRA compliance — from risk assessment and security objectives to testing, SBOM management, and vulnerability analysis — while remaining adaptable to future standardization updates.",[197,224,225],{},"During the discussion, participants raised questions about the balance between simplification and assurance, as well as how the approach connects with open source ecosystems, the upcoming Product Liability Directive, and ENISA guidance under NIS 2. Roger emphasized that sCC4CRA is not a replacement for other standards but rather a bridge — one that aims to make compliance more transparent and achievable.",[197,227,228],{},"“My goal,” he explained, “is to make CRA compliance practical for manufacturers who don’t have a team of certification experts. If we can lower the entry barrier, we can raise the baseline of security across the ecosystem.”",[197,230,231],{},"In closing, Roger shared that he continues to refine the methodology alongside his colleagues in the standardization community and invited contributions from anyone interested in testing or improving the framework. The full methodology is publicly available on GitHub, and Roger plans to release supporting templates and training materials in the near future.",[233,234,236],"h1",{"id":235},"watch-the-video","Watch the Video",[238,239],"youtube",{"description":240,"id":241,"title":242,"uploadDate":243},"Let's unpack the sCC4CRA methodology, specially designed to facilitate early compliance for default products, based on EUCC, fully self-assessed and simplified for CRA. This session covers: - What is sCC4CRA and why it matters - EUCC vs sCC4CRA: key differences - sCC4CRA alignment with standardisation work - how to use sCC4CRA - Future and next steps","2JfterY07j8","CRA Mondays | Demystifying \"simplified CC for CRA\"","2025-10-17",{"title":245,"searchDepth":246,"depth":246,"links":247},"",2,[],"2025-10-28","md",{},"\u002Fblog\u002Fcra-monday-roger-riera",{"title":190},"blog\u002Fcra-monday-roger-riera","Q0KT8znUamSpdtirs_CdcdX9yuyGo9dr2wg7UrAKhNg",[256],{"path":257,"visibility":191},"\u002Fblog",false,[260,263],{"path":261,"text":262},"\u002F","ORC",{"path":257,"text":109},1792684542936]