[{"data":1,"prerenderedAt":470},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fblog\u002Forc-monthly-march2025":188,"sections:\u002Fblog\u002Forc-monthly-march2025":461,"feed:\u002Fblog\u002Forc-monthly-march2025":464,"breadcrumbs:\u002Fblog\u002Forc-monthly-march2025":465},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":190,"aliases":191,"author":192,"body":193,"breadcrumbTitle":191,"breadcrumbs":191,"date":454,"description":191,"extension":455,"featuredFooter":191,"keywords":191,"meta":456,"navigation":92,"path":457,"redirectUrl":191,"seo":458,"seoTitle":191,"socialImage":191,"stem":459,"summary":191,"typography":191,"visibility":191,"width":191,"__hash__":460},"blog\u002Fblog\u002Forc-monthly-march2025.md","ORC Monthly: Cyber Resilience Spec Project, Deliverables Plan and Feedback for the European Commission",null,"Juan Rico",{"type":194,"value":195,"toc":443},"minimark",[196,200,212,217,267,271,306,310,314,322,332,340,349,356,360,396,400,403,417,421],[197,198,199],"p",{},"The Cyber Resilience SIG reached a critical milestone by defining a scope of work for 2025. The Cyber Resilience Practices Spec project has also launched, with project proposal and feedback open for review and contribution. The Open Regulatory Compliance WG attended several recent industry events including Embedded World 2025.",[197,201,202,206,209],{},[203,204,205],"em",{},"Timo Perala and Dirk-Willem van Gulik",[207,208],"br",{},[203,210,211],{},"ORC co-chairs",[213,214,216],"h2",{"id":215},"whats-new","What’s New",[218,219,220,237,250,259],"ul",{},[221,222,223,230,231,236],"li",{},[224,225,229],"a",{"href":226,"rel":227},"https:\u002F\u002Fprojects.eclipse.org\u002Fprojects\u002Ftechnology.crp",[228],"nofollow","Cyber Resilience Practices Specification project"," has been launched. This project aims to provide specifications to support the implementation of the CRA horizontal standards. You can review the proposal ",[224,232,235],{"href":233,"rel":234},"https:\u002F\u002Fprojects.eclipse.org\u002Fproposals\u002Fcyber-resilience-practices",[228],"here",".",[221,238,239,240,245,246],{},"The Cyber Resilience SIG ",[224,241,244],{"href":242,"rel":243},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fcyber-resilience-sig#deliverables",[228],"deliverables plan"," was approved, including scope and areas of prioritisation. Check it out and learn more about our activities and how to contribute: ",[224,247,248],{"href":248,"rel":249},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Forcwg\u002Ftree\u002Fmain\u002Fcyber-resilience-sig",[228],[221,251,252,253,258],{},"At the ",[224,254,257],{"href":255,"rel":256},"https:\u002F\u002Fwww.enisa.europa.eu\u002Fevents\u002Fcybersecurity_standardisation_2025",[228],"9th Cybersecurity Standardisation Conference"," on Thursday, March 20 ORC WG Senior Technical Lead Tobie Langel spoke at a panel called, “Overarching Cybersecurity by Standards.”",[221,260,261,262,236],{},"Program Manager, Juan Rico, represented the ORC WG at Embedded World 2025. The Cyber Resilience Act was a hot topic in the embedded community with many organisations discussing their approach to compliance and voicing their concerns about the ",[224,263,266],{"href":264,"rel":265},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fblob\u002Fmain\u002Ffaq.md",[228],"unanswered questions",[213,268,270],{"id":269},"top-conversations","Top Conversations",[218,272,273,292,299],{},[221,274,275,276,281,282,286,287,236],{},"The Cyber Resilience Act requires the European Commission to specify the ",[224,277,280],{"href":278,"rel":279},"https:\u002F\u002Fec.europa.eu\u002Finfo\u002Flaw\u002Fbetter-regulation\u002Fhave-your-say\u002Finitiatives\u002F14449-Technical-description-of-important-and-critical-products-with-digital-elements_en",[228],"technical description of important and critical products with digital elements",". ",[283,284,285],"strong",{},"Feedback is due by April 15, 2025",". Join the discussion on ORC’s ",[224,288,291],{"href":289,"rel":290},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Ftree\u002Fmain\u002Fproduct-definitions",[228],"CRA Hub",[221,293,294],{},[224,295,298],{"href":296,"rel":297},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F170",[228],"Can a project be without a steward?",[221,300,301,302,236],{},"Does a definition of a product category matter to a manufacturer or open source maintainer? The ORC WG is collecting feedback from the open source world and you can ",[224,303,305],{"href":289,"rel":304},[228],"contribute via pull requests",[213,307,309],{"id":308},"overheard","Overheard",[213,311,313],{"id":312},"upcoming-events","Upcoming Events",[197,315,316,321],{},[224,317,320],{"href":318,"rel":319},"https:\u002F\u002Fwww.first.org\u002Fconference\u002Fvulncon2025\u002F",[228],"CVE\u002FFIRST VulnCon 2025 & Annual CNA Summit | April 7-10"," - Collaborate with various vulnerability management and cybersecurity professionals to develop forward leaning ideas that can be taken back to individual programs for action to benefit the vulnerability management ecosystem.",[218,323,324],{},[221,325,326,327,236],{},"Marta Rybczynska and Mikael Barbero of the Eclipse Foundation will host a talk called, “Towards a Vulnerability Reporting Specification.” The talk can also be attended virtually for those not able to attend in-person. ",[224,328,331],{"href":329,"rel":330},"https:\u002F\u002Fwww.first.org\u002Fconference\u002Fvulncon2025\u002F#Registration-Information",[228],"Register now",[197,333,334,339],{},[224,335,338],{"href":336,"rel":337},"https:\u002F\u002Fwww.ds.dk\u002Fen\u002Four-services\u002Fworkshop-cyber-resilience-act",[228],"Workshop: Cyber Resilience Act and the horizontal standard | April 8"," - The workshop will provide a comprehensive understanding of how standards can effectively mitigate risks, enhance cybersecurity posture, and ensure that products and services are aligned with the legal expectations set forth by the Act.",[218,341,342],{},[221,343,344,345],{},"Tobie Langel will present at the workshop, which is available to attend online as well as in-person. ",[224,346,348],{"href":336,"rel":347},[228],"Register now.",[197,350,351],{},[224,352,355],{"href":353,"rel":354},"https:\u002F\u002Forcwg.org\u002Fevents\u002F",[228],"View all events",[213,357,359],{"id":358},"recent-talks","Recent Talks",[218,361,362,370],{},[221,363,364,365],{},"Recap from Victor Roland: ",[224,366,369],{"href":367,"rel":368},"https:\u002F\u002Fblog.obeosoft.com\u002Fa-two-day-panel-on-the-cyber-resilience-act-cra",[228],"A two-day panel on the Cyber Resilience Act (CRA)",[221,371,372,373],{},"CRA ORC WG Workshop - 30 January\n",[218,374,375,382,389],{},[221,376,377],{},[224,378,381],{"href":379,"rel":380},"https:\u002F\u002Fyoutu.be\u002FjcaU3AX7llk?si=YwrihjfkgndC_uBw",[228],"CRA Implementation for Open Source & How ORC Contributes to the Landscape",[221,383,384],{},[224,385,388],{"href":386,"rel":387},"https:\u002F\u002Fyoutu.be\u002FDHp9SxpxIss",[228],"Anticipating the Cyber Resilience Act: The CCNL’s practical guide",[221,390,391],{},[224,392,395],{"href":393,"rel":394},"https:\u002F\u002Fyoutu.be\u002FXXyVTzkoZrk",[228],"ORC Workshop Wrap-up",[213,397,399],{"id":398},"welcome-orc-members","Welcome ORC Members",[197,401,402],{},"The following members have joined in March 2025:",[218,404,405,408,411,414],{},[221,406,407],{},"Clever Cloud SAS",[221,409,410],{},"Debian France",[221,412,413],{},"Drupal Association",[221,415,416],{},"Ferrous Systems GmbH",[213,418,420],{"id":419},"how-to-participate","How to Participate",[218,422,423,429,436],{},[221,424,425],{},[224,426,428],{"href":98,"rel":427},[228],"Learn",[221,430,431],{},[224,432,435],{"href":433,"rel":434},"https:\u002F\u002Fgithub.com\u002Forcwg",[228],"Contribute",[221,437,438],{},[224,439,442],{"href":440,"rel":441},"https:\u002F\u002Forcwg.org\u002Fmembership\u002F",[228],"Join the Working Group",{"title":444,"searchDepth":445,"depth":445,"links":446},"",2,[447,448,449,450,451,452,453],{"id":215,"depth":445,"text":216},{"id":269,"depth":445,"text":270},{"id":308,"depth":445,"text":309},{"id":312,"depth":445,"text":313},{"id":358,"depth":445,"text":359},{"id":398,"depth":445,"text":399},{"id":419,"depth":445,"text":420},"2025-03-25","md",{},"\u002Fblog\u002Forc-monthly-march2025",{"title":190},"blog\u002Forc-monthly-march2025","pNN45397rOv6v3xAUnweM5JFM1ovZBfN_ohYvEiqbvg",[462],{"path":463,"visibility":191},"\u002Fblog",false,[466,469],{"path":467,"text":468},"\u002F","ORC",{"path":463,"text":109},1792684544358]