[{"data":1,"prerenderedAt":357},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fblog\u002Fvoluntary-attestations-survey":188,"sections:\u002Fblog\u002Fvoluntary-attestations-survey":348,"feed:\u002Fblog\u002Fvoluntary-attestations-survey":351,"breadcrumbs:\u002Fblog\u002Fvoluntary-attestations-survey":352},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":190,"aliases":191,"author":192,"body":193,"breadcrumbTitle":191,"breadcrumbs":191,"date":341,"description":191,"extension":342,"featuredFooter":191,"keywords":191,"meta":343,"navigation":92,"path":344,"redirectUrl":191,"seo":345,"seoTitle":191,"socialImage":191,"stem":346,"summary":191,"typography":191,"visibility":191,"width":191,"__hash__":347},"blog\u002Fblog\u002Fvoluntary-attestations-survey.md","Understanding Voluntary Security Attestations: Insights from the Survey",null,"Æva Black and Greg Wallace",{"type":194,"value":195,"toc":327},"minimark",[196,213,222,227,230,252,256,259,264,267,287,291,298,302,305,309,312,315,318],[197,198,199,200,204,205,212],"p",{},"With the Cyber Resilience Act (CRA) introducing new expectations for digital\nproducts, the open source community is exploring how to navigate these\nrequirements thoughtfully, while improving long term sustainability of the\necosystem. One potential path is the use of ",[201,202,203],"strong",{},"Voluntary Security Attestations","\n(",[206,207,211],"a",{"href":208,"rel":209},"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=OJ:L_202402847#art_25",[210],"nofollow","defined in art. 25 of the CRA","),\na way for projects to communicate their security practices clearly and\nconsistently.",[197,214,215,216,221],{},"To better understand the practical opportunities, the ",[206,217,220],{"href":218,"rel":219},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-attestations",[210],"CRA Attestations project","\nsurveyed 151 developers and commercial users, to see if attestations could\nactually bridge the gap between regulatory needs and the reality of open source\nmaintenance.",[223,224,226],"h2",{"id":225},"listening-to-the-ecosystem","Listening to the Ecosystem",[197,228,229],{},"The survey, conducted between late January and mid-February 2026, aimed to move\npast assumptions. We focused on three key areas:",[231,232,233,240,246],"ul",{},[234,235,236,239],"li",{},[201,237,238],{},"Utility:"," Which security documents actually help a company feel safe using\na project?",[234,241,242,245],{},[201,243,244],{},"Feasibility:"," What can a maintainer realistically provide without burning\nout?",[234,247,248,251],{},[201,249,250],{},"Sustainability:"," Could this framework create a way for companies to better\nsupport the projects they depend on?",[223,253,255],{"id":254},"key-findings","Key Findings",[197,257,258],{},"The data suggests that security attestations can be a valuable tool for\nbuilding trust and ensuring the long-term health of the ecosystem.",[260,261,263],"h3",{"id":262},"_1-high-impact-low-friction-practices","1. High-Impact, Low-Friction Practices",[197,265,266],{},"The report identified a “sweet spot” of information that is relatively easy for\nproject maintainers to provide and highly valuable for the manufacturers that\nrely on open source. This includes:",[231,268,269,275,281],{},[234,270,271,274],{},[201,272,273],{},"Documented Vulnerability and Security Policies:"," Knowing exactly how a\nproject team approaches secure software development, handles vulnerabilities,\nand communicates and releases fixes.",[234,276,277,280],{},[201,278,279],{},"Predictable Release Cadences:"," Understanding how the project signals\nrelease cycles and when major versions will reach end-of-life.",[234,282,283,286],{},[201,284,285],{},"Security Reviews:"," External security audits, even occasional ones, act as\nsignificant trust signals.",[260,288,290],{"id":289},"_2-a-bridge-to-financial-sustainability","2. A Bridge to Financial Sustainability",[197,292,293,294,297],{},"One of the most encouraging findings was the link between compliance and\nsupport. ",[201,295,296],{},"57.6% of commercial users"," indicated they would be more willing to\nprovide financial support to a project if it provided attestations that reduced\ntheir own internal auditing or certification costs. This suggests that\n“compliance” doesn’t have to be a burden on open source maintainers; it can\nbecome a common basis for corporate investment in project development and\nmaintenance.",[260,299,301],{"id":300},"_3-global-consensus","3. Global Consensus",[197,303,304],{},"Interestingly, the survey found a high degree of alignment across different\nregions and company sizes. Whether in Europe or abroad, the industry\nrespondents largely agreed on what constitutes “good” security information.\nThis consensus is a vital signal that creating a standardised approach should\nbe possible.",[223,306,308],{"id":307},"next-steps","Next Steps",[197,310,311],{},"The results of the survey provide a humble but clear roadmap. Moving forward,\nthe CRA Attestations project will focus on developing a better understanding of\nimplementation guidelines for third-party due diligence and how a voluntary\nsecurity attestation programme can support such requirements while respecting\nthe diversity of the open source community.",[197,313,314],{},"By focusing on transparency and mutual benefit, we can ensure that the Cyber\nResilience Act strengthens, rather than hinders, the open source spirit.",[260,316,100],{"id":317},"resources",[197,319,320,321,326],{},"The report and the raw data are available as part of the resources generated\nby the ",[206,322,325],{"href":323,"rel":324},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-attestations\u002Ftree\u002Fmain\u002Fevents\u002F2026-02-attestation-survey",[210],"CRA Attestations project here",".",{"title":328,"searchDepth":329,"depth":329,"links":330},"",2,[331,332,338],{"id":225,"depth":329,"text":226},{"id":254,"depth":329,"text":255,"children":333},[334,336,337],{"id":262,"depth":335,"text":263},3,{"id":289,"depth":335,"text":290},{"id":300,"depth":335,"text":301},{"id":307,"depth":329,"text":308,"children":339},[340],{"id":317,"depth":335,"text":100},"2026-04-30","md",{},"\u002Fblog\u002Fvoluntary-attestations-survey",{"title":190},"blog\u002Fvoluntary-attestations-survey","uYtkLnrYZ6oo2LoxMwJi3KJNEfDDRFZusyYTXdhEaLo",[349],{"path":350,"visibility":191},"\u002Fblog",false,[353,356],{"path":354,"text":355},"\u002F","ORC",{"path":350,"text":109},1792684541526]