[{"data":1,"prerenderedAt":587},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fblog\u002Forc-monthly-july2025":188,"sections:\u002Fblog\u002Forc-monthly-july2025":578,"feed:\u002Fblog\u002Forc-monthly-july2025":581,"breadcrumbs:\u002Fblog\u002Forc-monthly-july2025":582},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":190,"aliases":191,"author":192,"body":193,"breadcrumbTitle":191,"breadcrumbs":191,"date":571,"description":191,"extension":572,"featuredFooter":191,"keywords":191,"meta":573,"navigation":92,"path":574,"redirectUrl":191,"seo":575,"seoTitle":191,"socialImage":191,"stem":576,"summary":191,"typography":191,"visibility":191,"width":191,"__hash__":577},"blog\u002Fblog\u002Forc-monthly-july2025.md","ORC Monthly: Regulatory Submissions and Code & Compliance Community Day",null,"Juan Rico",{"type":194,"value":195,"toc":561},"minimark",[196,226,229,242,247,370,374,385,393,397,438,442,476,485,489,492,535,539],[197,198,199,200,207,208,213,214,219,220,225],"p",{},"As we dive into the summer months, we’re combining our June and July updates into a single post, because June was packed. In June alone, we contributed to the ",[201,202,206],"a",{"href":203,"rel":204},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#23-contribution-to-open-source-eu-guidance-on-open-source-hardware",[205],"nofollow","EU’s draft guidance on open source hardware",", submitted detailed comments on the ",[201,209,212],{"href":210,"rel":211},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#25-comments-on-cencenelec-pt-1-standard",[205],"CEN\u002FCENELEC PT 1 Standard",", and provided feedback on the proposed ",[201,215,218],{"href":216,"rel":217},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#26-feedback-on-cybersecurity-act-csa-revision",[205],"Cybersecurity Act (CSA) Revision",". We also offered further refinements to the ",[201,221,224],{"href":222,"rel":223},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#27-comments-to-eu-guidance-on-open-source",[205],"EU’s guidance on open source"," in general. These submissions reflect the ORC’s growing role as a trusted voice in the policy conversation around open source and cybersecurity in Europe.",[197,227,228],{},"To improve the community’s efficiency, we have refined our internal review and feedback process, enabling us to respond more quickly and effectively to fast-moving developments. This momentum puts us in a strong position to continue influencing these conversations in a way that represents the interests of the open source community.",[197,230,231,235,236,239],{},[232,233,234],"em",{},"Timo Perala and Dirk-Willem van Gulik"," ",[237,238],"br",{},[232,240,241],{},"ORC co-chairs",[243,244,246],"h2",{"id":245},"whats-new","What’s New",[248,249,250,260,269,278,287,322],"ul",{},[251,252,253,254,259],"li",{},"Save the date for ",[201,255,258],{"href":256,"rel":257},"https:\u002F\u002Fwww.eclipse-foundation.events\u002Fevent\u002FCode-and-compliance-Community-Day-2025\u002Fsummary",[205],"Code and Compliance",". Preparations are already in motion for the first edition of Code and Compliance Community Day, set to take place in Brussels on October 22 and 23. If you’re interested in shaping the program or contributing to the content, now is the time to get involved.",[251,261,262,263,268],{},"The first drafts of the horizontal standards from CEN\u002FCENELEC have been released for internal review. The ORC submitted ",[201,264,267],{"href":265,"rel":266},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fcoordination\u002Fcen-cenelec-wg-9\u002Fdeliverable-2-5.md",[205],"feedback to PT1"," and is currently preparing input for Part 3 (PT3).",[251,270,271,272,277],{},"While the CRA remains the core focus of the Working Group, we’ve also provided consolidated input on related legislative efforts, including the proposed revisions to the Cybersecurity Act (CSA). You can read our comments ",[201,273,276],{"href":274,"rel":275},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fcoordination\u002Fenisa\u002Fdeliverable-2-6.md",[205],"here",".",[251,279,280,281,286],{},"The ORC community collaborated to deliver ",[201,282,285],{"href":283,"rel":284},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fcoordination\u002Feuropean-commission\u002Fdeliverable-2-8.md",[205],"feedback on the European Commission’s consultation on the Standardisation Regulation No 1025\u002F2012",". Our response emphasised how the process can evolve to better accommodate the open source ecosystem as an essential stakeholder.",[251,288,289,290,295,296],{},"Our weekly ",[201,291,294],{"href":292,"rel":293},"https:\u002F\u002Fwww.youtube.com\u002Fplaylist?list=PLy7t4z5SYNaT-DjqGR0ORSSZGZYW8qmRs",[205],"CRA Mondays"," series is taking a break over the summer months.  If you missed any of the discussions, now’s a great time to catch up on the recordings and stay informed on the latest CRA-related topics, including:",[248,297,298,305,312,319],{},[251,299,300],{},[201,301,304],{"href":302,"rel":303},"https:\u002F\u002Fyoutu.be\u002FSP1xjDDLt9U?si=oINjRY8IHMy1NBxi",[205],"The CRA: Why even your fridge might need a lawyer",[251,306,307],{},[201,308,311],{"href":309,"rel":310},"https:\u002F\u002Fyoutu.be\u002F5t9EGPTll64?si=eY7lCE-vaSLRHmvO",[205],"Supply-chain Levels for Software Artifacts (SLSA)",[251,313,314],{},[201,315,318],{"href":316,"rel":317},"https:\u002F\u002Fyoutu.be\u002F7CbHwsKVD80?si=CXlxksgYXEeQdL8H",[205],"How to stop worrying and love the NLF",[251,320,321],{},"And more",[251,323,324,325,362,364,365,277],{},"The ORC is currently developing a series of white papers focused on key aspects of cybersecurity and open source. Topics include:",[248,326,327,334,341,348,355],{},[251,328,329],{},[201,330,333],{"href":331,"rel":332},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#31-white-paper-on-sboms",[205],"SBOMs",[251,335,336],{},[201,337,340],{"href":338,"rel":339},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#32-white-paper-on-due-diligence-obligation-of-manufacturers",[205],"Due diligence obligation of manufacturers",[251,342,343],{},[201,344,347],{"href":345,"rel":346},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#33-white-paper-on-security-attestations",[205],"Security attestations",[251,349,350],{},[201,351,354],{"href":352,"rel":353},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#34-white-paper-on-types-of-open-source-projects",[205],"Types of open source projects",[251,356,357],{},[201,358,361],{"href":359,"rel":360},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#35-white-paper-open-source-software-stewards-and-cra",[205],"Open Source Software Stewards and CRA",[237,363],{},"If you’re interested in contributing your expertise or reviewing drafts, we welcome your participation. Learn more and get involved on ",[201,366,369],{"href":367,"rel":368},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Fblob\u002Fmain\u002Fcyber-resilience-sig\u002Fdeliverables.md#3-white-papers",[205],"GitHub",[243,371,373],{"id":372},"overheard","Overheard",[197,375,376],{},[201,377,380],{"href":378,"rel":379},"https:\u002F\u002Fmastodon.social\u002F@bagder\u002F114835333719454616",[205],[381,382],"img",{"alt":383,"src":384},"Daniel Stenberg's Mastodon post linked to his article Cyber Risk Assessment Request","\u002Fblog\u002Forc-monthly-july2025\u002Fimages\u002Fjuly-overheard.png",[197,386,387,388],{},"We’re also on Mastodon: ",[201,389,392],{"href":390,"rel":391},"https:\u002F\u002Fmastodon.social\u002F@orcwg@fosstodon.org",[205],"@orcwg",[243,394,396],{"id":395},"upcoming-events","Upcoming Events",[248,398,399,407,415,423,431],{},[251,400,401,406],{},[201,402,405],{"href":403,"rel":404},"https:\u002F\u002Fevents.linuxfoundation.org\u002Fopen-source-summit-europe\u002F",[205],"Open Source Summit Europe"," | 25 - 27 August 2025",[251,408,409,414],{},[201,410,413],{"href":411,"rel":412},"https:\u002F\u002Fcomply.land\u002F",[205],"Comply.Land"," | 11 September 2025 - 12 September 2025",[251,416,417,422],{},[201,418,421],{"href":419,"rel":420},"https:\u002F\u002Fwww.thethingsconference.com\u002F",[205],"The Things Conference"," | 23 - 24 September 2025",[251,424,425,430],{},[201,426,429],{"href":427,"rel":428},"https:\u002F\u002Fnsss.se\u002Fy2025\u002F",[205],"Nordic Software Security Summi","t | 1-3 October 2025",[251,432,433,437],{},[201,434,436],{"href":256,"rel":435},[205],"Code & Compliance Community Day"," | 22-23 October 2025",[243,439,441],{"id":440},"recent-talks-events","Recent Talks & Events",[248,443,444,451,458,465,468],{},[251,445,446],{},[201,447,450],{"href":448,"rel":449},"https:\u002F\u002Fyoutu.be\u002F5t9EGPTll64?si=E0qgPU9-dwcXM01T",[205],"CRA Mondays | Supply-chain Levels for Software Artifacts (SLSA) | Arnaud Le Hors",[251,452,453],{},[201,454,457],{"href":455,"rel":456},"https:\u002F\u002Fyoutu.be\u002FSP1xjDDLt9U?si=Dl-i1MVQhuauDikq",[205],"CRA Mondays | The CRA: Why even your fridge might need a lawyer | Pedro Demolder",[251,459,460],{},[201,461,464],{"href":462,"rel":463},"https:\u002F\u002Fyoutu.be\u002FgSonHFkmuyQ?si=JHF9TQCEJaPIifFG",[205],"Unpacking the CRA: From Draft to Delivery – ORC Working Group’s first deliverables",[251,466,467],{},"Digital Enterprise Show - Malaga June 2025",[251,469,470,475],{},[201,471,474],{"href":472,"rel":473},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fevents\u002F2025-07-global-digital-collaboration",[205],"Global Digital Collaboration Conference"," - well-attended sessions on “Soverign by Design”",[197,477,478],{},[201,479,481],{"href":378,"rel":480},[205],[381,482],{"alt":483,"src":484},"Speaker at Global Digital Collaboration Conference","\u002Fblog\u002Forc-monthly-july2025\u002Fimages\u002Fjuly-events.png",[243,486,488],{"id":487},"welcome-orc-members","Welcome ORC Members",[197,490,491],{},"The following members joined in June and July 2025:",[248,493,494,501,508,515,522,528],{},[251,495,496],{},[201,497,500],{"href":498,"rel":499},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002Fshow-member\u002F?member_id=731",[205],"Red Hat",[251,502,503],{},[201,504,507],{"href":505,"rel":506},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002FshowMember.php?member_id=1592",[205],"Google",[251,509,510],{},[201,511,514],{"href":512,"rel":513},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002FshowMember.php?member_id=1752",[205],"Open Source Matters",[251,516,517],{},[201,518,521],{"href":519,"rel":520},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002FshowMember.php?member_id=1697",[205],"Ekxide IO",[251,523,524],{},[201,525,369],{"href":526,"rel":527},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002FshowMember.php?member_id=1754",[205],[251,529,530],{},[201,531,534],{"href":532,"rel":533},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002Fshow-member\u002F?member_id=1196",[205],"Microsoft",[243,536,538],{"id":537},"how-to-participate","How to Participate",[248,540,541,547,554],{},[251,542,543],{},[201,544,546],{"href":98,"rel":545},[205],"Learn",[251,548,549],{},[201,550,553],{"href":551,"rel":552},"https:\u002F\u002Fgithub.com\u002Forcwg",[205],"Contribute",[251,555,556],{},[201,557,560],{"href":558,"rel":559},"https:\u002F\u002Forcwg.org\u002Fmembership\u002F",[205],"Join the Working Group",{"title":562,"searchDepth":563,"depth":563,"links":564},"",2,[565,566,567,568,569,570],{"id":245,"depth":563,"text":246},{"id":372,"depth":563,"text":373},{"id":395,"depth":563,"text":396},{"id":440,"depth":563,"text":441},{"id":487,"depth":563,"text":488},{"id":537,"depth":563,"text":538},"2025-07-30","md",{},"\u002Fblog\u002Forc-monthly-july2025",{"title":190},"blog\u002Forc-monthly-july2025","GhB9ARVM5e4vfptaG5mjyboo6W9MDqHa2VHegTzG68g",[579],{"path":580,"visibility":191},"\u002Fblog",false,[583,586],{"path":584,"text":585},"\u002F","ORC",{"path":580,"text":109},1792684543706]