[{"data":1,"prerenderedAt":733},["ShallowReactive",2],{"site:settings":3,"site:navigation":49,"site:footer":126,"page:\u002Fcra":188,"sections:\u002Fcra":635,"feed:\u002Fcra":92,"deliverables":636},{"id":4,"title":5,"callForAction":6,"description":9,"extension":10,"featuredContentPublishTarget":11,"keywords":12,"logo":18,"logoWidth":19,"meta":20,"search":21,"seoTitleSuffix":25,"skipLinkText":26,"socialImage":27,"socials":30,"stem":47,"__hash__":48},"settings\u002Fdata\u002Fsettings.yml","Open Regulatory Compliance Working Group",{"text":7,"href":8},"Get involved","\u002Fparticipate\u002F","The open source community is collaborating to establish common specifications for secure software development based on open source best practices.","yml","orc",[13,14,15,16,17],"regulatory compliance","cybersecurity processes","royalty-free patent licence","open source community collaboration","Eclipse Foundation Specification Process","\u002Fimages\u002Forc-logo.png",120,{},{"label":22,"placeholder":23,"menuLabel":24},"Search","Search the site…","Menu"," | Open Regulatory Compliance Working Group","Skip to main content",{"backgroundImage":28,"eyebrow":29},"\u002Fimages\u002Fog\u002Fbackground.jpg","orcwg.org",[31,35,39,43],{"name":32,"icon":33,"url":34},"LinkedIn","fa6-brands:linkedin-in","https:\u002F\u002Fwww.linkedin.com\u002Fshowcase\u002Fopen-regulatory-compliance\u002F",{"name":36,"icon":37,"url":38},"YouTube","fa6-brands:youtube","https:\u002F\u002Fwww.youtube.com\u002F@ORCWG",{"name":40,"icon":41,"url":42},"Bluesky","fa6-brands:bluesky","https:\u002F\u002Fbsky.app\u002Fprofile\u002Forcwg.org",{"name":44,"icon":45,"url":46},"Mastodon","fa6-brands:mastodon","https:\u002F\u002Ffosstodon.org\u002F@orcwg","data\u002Fsettings","bxtnzYEG4TQ27x8O_VKQIF-gc2dr-DNwF9_OpAZy3LA",{"id":50,"extension":10,"main":51,"meta":123,"stem":124,"__hash__":125},"navigation\u002Fdata\u002Fnavigation.yml",[52,70,82,99],{"text":53,"children":54},"About",[55,58,61,64,67],{"text":56,"href":57},"ORC Working Group","\u002Fabout\u002F",{"text":59,"href":60},"Cyber Resilience SIG","\u002Fspecial-interest-groups\u002Fcyber-resilience\u002F",{"text":62,"href":63},"AI Policy & Compliance SIG","\u002Fspecial-interest-groups\u002Fai-policy-and-compliance\u002F",{"text":65,"href":66},"Steering Committee","\u002Fcommittees\u002Fsteering-committee\u002F",{"text":68,"href":69},"Meeting Minutes","\u002Fcommittees\u002Fminutes\u002F",{"text":71,"children":72},"Membership",[73,76,79],{"text":74,"href":75},"Our Members","\u002Fmembership\u002F",{"text":77,"href":78},"Become a Member","\u002Fmembership\u002Fbecome-a-member\u002F",{"text":80,"href":81},"Participation and Membership FAQ","\u002Fabout\u002Fparticipation-and-membership-faq\u002F",{"id":83,"text":84,"children":85},"cra","Cyber Resilience Act",[86,89,93,96],{"text":87,"href":88},"About CRA","\u002Fcra\u002Fabout",{"text":90,"href":91,"external":92},"CRA FAQ","https:\u002F\u002Fcra.orcwg.org\u002F",true,{"text":94,"href":95},"CRA Resources","\u002Fcra\u002Fresources",{"text":97,"href":98,"external":92},"CRA Hub on GitHub","https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub",{"text":100,"children":101},"Resources",[102,105,108,111,114,117,120],{"text":103,"href":104},"Events","\u002Fevents\u002F",{"text":106,"href":107},"Community Calendar","\u002Fresources\u002Fcalendar\u002F",{"text":109,"href":110},"Blog","\u002Fblog\u002F",{"text":112,"href":113},"Videos","\u002Fresources\u002Fvideos\u002F",{"text":115,"href":116},"Learning Hub","\u002Ftraining\u002F",{"text":118,"href":119},"Marketing Resources","\u002Fresources\u002Fmarketing-resources\u002F",{"text":121,"href":122,"external":92},"ORC Store","https:\u002F\u002Feclipse-foundation.store\u002Fcollections\u002Fopen-regulatory-compliance-orc",{},"data\u002Fnavigation","XYDVypNX67n8V4VQI_JTrw0cI16uV5jtctVXjN-DeKo",{"id":127,"backToTopText":128,"copyright":129,"extension":10,"manageCookiesText":130,"meta":131,"sections":132,"socialsHeading":185,"stem":186,"__hash__":187},"footer\u002Fdata\u002Ffooter.yml","Back to the top","Copyright © Eclipse Foundation AISBL. All Rights Reserved.","Manage Cookies",{},[133,150,169],{"id":134,"heading":135,"links":136},"footer-eclipse-foundation","Eclipse Foundation",[137,139,142,145,147],{"text":53,"href":138},"https:\u002F\u002Fwww.eclipse.org\u002Forg\u002F",{"text":140,"href":141},"Projects","https:\u002F\u002Fprojects.eclipse.org\u002F",{"text":143,"href":144},"Collaborations","https:\u002F\u002Fwww.eclipse.org\u002Fcollaborations\u002F",{"text":71,"href":146},"https:\u002F\u002Fwww.eclipse.org\u002Fmembership\u002F",{"text":148,"href":149},"Sponsor","https:\u002F\u002Fwww.eclipse.org\u002Fsponsor\u002F",{"id":151,"heading":152,"showManageCookies":92,"links":153},"footer-legal","Legal",[154,157,160,163,166],{"text":155,"href":156},"Privacy Policy","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fprivacy\u002F",{"text":158,"href":159},"Terms of Use","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fterms-of-use\u002F",{"text":161,"href":162},"Compliance","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002Fcompliance\u002F",{"text":164,"href":165},"Code of Conduct","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Fdocuments\u002FCommunity_Code_of_Conduct.php",{"text":167,"href":168},"Legal Resources","https:\u002F\u002Fwww.eclipse.org\u002Flegal\u002F",{"id":170,"heading":171,"links":172},"footer-more","More",[173,176,179,182],{"text":174,"href":175},"Report a Vulnerability","https:\u002F\u002Fwww.eclipse.org\u002Fsecurity\u002F",{"text":177,"href":178},"Service Status","https:\u002F\u002Fstatus.eclipse.org\u002F",{"text":180,"href":181},"Contact Us","https:\u002F\u002Fwww.eclipse.org\u002Forg\u002Ffoundation\u002Fcontact.php",{"text":183,"href":184},"Support","https:\u002F\u002Fwww.eclipse.org\u002Fprojects\u002Fsupport\u002F","Follow Us:","data\u002Ffooter","C-lpCHl9crwF3iQyRSh8y5g9ez5YgF4pi8aTv4pFLBM",{"id":189,"title":190,"aliases":191,"body":192,"breadcrumbTitle":619,"breadcrumbs":620,"date":621,"description":622,"extension":623,"featuredFooter":621,"header":624,"keywords":621,"meta":628,"navigation":92,"path":629,"redirectUrl":621,"rssFeed":621,"seo":630,"seoTitle":621,"socialImage":621,"stem":631,"typography":632,"visibility":621,"width":633,"__hash__":634},"pages\u002Fcra\u002Findex.md","Understanding the EU Cyber Resilience Act and Its Impact on Open Source",[88],{"type":193,"value":194,"toc":615},"minimark",[195,208,243,390,527,552,555],[196,197,201,205],"card",{"variant":198,"spacing-bottom":199,"width":200},"filled","small","narrow",[202,203,204],"p",{},"This guide provides the most up-to-date information on the Cyber Resilience Act (CRA), a European Union law that establishes mandatory cybersecurity requirements for products with digital elements.",[202,206,207],{},"If you manufacture, maintain, or steward open source software, now is the time to review these resources alongside your existing vulnerability management and incident response processes.",[209,210,213,224,232,236],"page-section",{"titleAlign":211,"titleStyle":199,"spacingTop":199,"textAlign":211,"width":212},"center","medium",[202,214,215,216,223],{},"Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents affecting products with digital elements. Notifications are submitted through the ",[217,218,222],"a",{"href":219,"rel":220},"https:\u002F\u002Fwww.enisa.europa.eu\u002Ftopics\u002Fproduct-security\u002Fsingle-reporting-platform-srp",[221],"nofollow","Single Reporting Platform"," established by ENISA.",[202,225,226,227,231],{},"Additional ",[217,228,230],{"href":229},"#collapse-what-is-the-timeline","CRA requirements"," impacting manufacturers and those impacting open source software stewards apply from 11 December 2027.",[233,234],"countdown",{"date":235,"spacing-top":199},"2027-12-11T00:00:00",[237,238,240],"template",{"v-slot:title":239},"",[202,241,242],{},"Counting down to CRA compliance",[209,244,248,385],{"titleAlign":211,"titleStyle":245,"decoration":246,"spacingBottom":247,"spacingTop":247},"heading","glow-left","none",[249,250,251,269,286,326,365],"accordion",{},[252,253,256,264],"accordion-item",{"anchor":254,":open":255},"what-is-the-cra","true",[202,257,258,259,263],{},"The ",[217,260,84],{"href":261,"rel":262},"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F2847\u002Foj",[221]," (CRA) entered into force on 11 December 2024. CRA is a European law created to ensure that software products are designed and maintained with security in mind throughout their lifecycle.",[237,265,266],{"v-slot:title":239},[202,267,268],{},"What is the CRA?",[252,270,272,281],{"anchor":271},"why-is-the-cra-important",[202,273,274,275,280],{},"Hardware and software products are increasingly subject to cyberattacks. The inherent security risks of software are not well understood by consumers, yet estimates predict that cybercrime will cost the global economy more than 20 trillion USD by 2026 (Source: ",[217,276,279],{"href":277,"rel":278},"https:\u002F\u002Fwww.statista.com\u002Fstatistics\u002F1280009\u002Fcost-cybercrime-worldwide\u002F",[221],"Statista",").",[237,282,283],{"v-slot:title":239},[202,284,285],{},"Why is the EU Cyber Resilience Act important?",[252,287,289,296,308,314,321],{"anchor":288},"who-is-affected",[202,290,291,295],{},[292,293,294],"strong",{},"Manufacturers",": a software vendor or a vendor of a physical product with software components. Manufacturers include anyone who is placing a product on the European market, i.e. this is not limited to European companies.",[202,297,298,301,302,307],{},[292,299,300],{},"Open Source Maintainers",": The EU is in the process of developing guidance on how the law will impact maintainers who monetize an open source project. If you just contribute to open source or do not ",[217,303,306],{"href":304,"rel":305},"https:\u002F\u002Fgithub.com\u002Forcwg\u002Fcra-hub\u002Fissues\u002F16",[221],"monetize open source",", you will not be impacted directly by the CRA. However, you may experience indirect impact in terms of higher expectations around security.",[202,309,310,313],{},[292,311,312],{},"Open Source Stewards",": Code hosting foundations or for-profit organizations that are not monetizing the particular pieces of software they are stewarding.",[202,315,316,317,320],{},"Not sure where your organisation fits? Check out the ",[217,318,90],{"href":91,"rel":319},[221],".",[237,322,323],{"v-slot:title":239},[202,324,325],{},"Who is affected?",[252,327,329,338,341,351,356],{"anchor":328},"how-is-this-different",[202,330,331,332,337],{},"Full supply chain compliance has never been required before the CRA. In any kind of software application, about 24% is built in-house or procured and ",[217,333,336],{"href":334,"rel":335},"https:\u002F\u002Fwww.blackduck.com\u002Fblog\u002Fopen-source-trends-ossra-report.html",[221],"76% is open source dependencies",". The CRA impacts the entire supply chain, including the ~76% of OSS, in every product. This changes everything.",[202,339,340],{},"Compliance used to be internal policies and legal agreements with vendors. Now, the whole open source supply chain compliance will have to be brokered.",[202,342,343,350],{},[292,344,345],{},[217,346,349],{"href":347,"rel":348},"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F2847\u002Foj#art_64",[221],"The fines are severe",". Manufacturers will be fined if caught not in compliance. In addition to monetary fines, products will be removed from retail shelves until compliance is met.",[237,352,353],{"v-slot:title":239},[202,354,355],{},"How is this different from previous compliance requirements?",[237,357,358],{"v-slot:media":239},[202,359,360],{},[361,362],"img",{"alt":363,"src":364},"Bar chart titled 'CRA innovation: fully supply chain compliance'. TODO","\u002Fcra\u002Fimages\u002Fcra-innovation.png",[252,366,369,372,377],{"anchor":367,"media-position":368},"what-is-the-timeline","top",[202,370,371],{},"The Cyber Resilience Act (CRA) entered into force on 11 December 2024. Manufacturers must comply with vulnerability reporting requirements by 11 September 2026. Several compliance deadlines follow based on product classification: horizontal (type A) must comply by 30 August 2026, while vertical (type C) and horizontal (type B) have a compliance deadline of 30 October 2026. All other CRA obligations become fully applicable by 11 December 2027.",[237,373,374],{"v-slot:title":239},[202,375,376],{},"What is the timeline?",[237,378,379],{"v-slot:media":239},[202,380,381],{},[361,382],{"alt":383,"src":384},"11 December 2024 - CRA Entry into force (EIF); 30 August 2026 - Harmonized Standards: Horizontal (type A); 11 September 2026 - Vulnerability reporting; 30 October 2026 - Harmonized Standards: Vertical (type C), Horizontal (type B); 11 December 2027 - All other obligations.","\u002Fcra\u002Fimages\u002Fcra-timeline.png?v=1.1",[237,386,387],{"v-slot:title":239},[202,388,389],{},"About the Cyber Resilience Act",[209,391,393,455,487,518,522],{"titleAlign":211,"titleStyle":245,"decoration":392,"spacingBottom":247},"glow-bottom-right",[394,395,396,399,404],"content-card",{},[202,397,398],{},"In response to the evolving regulatory landscape introduced by the Cyber Resilience Act (CRA), the Open Regulatory Compliance (ORC) Working Group has mobilised a dedicated community effort to support open source stakeholders. Recognising the unique challenges faced by developers, maintainers, and organisations, we are collaboratively developing a comprehensive suite of resources designed to demystify the CRA and provide actionable guidance. Our key initiatives, each crafted through community input, empower stakeholders to achieve informed and effective compliance.",[237,400,401],{"v-slot:title":239},[202,402,403],{},"Community Resources",[237,405,406,426,441],{"v-slot:aside":239},[196,407,410,415,418],{"variant":408,"spacing-bottom":409,"padding":199},"bordered","x-small",[411,412,414],"h4",{"id":413},"cra-frequently-asked-questions-faq","CRA Frequently Asked Questions (FAQ)",[202,416,417],{},"The ORC community is actively developing this FAQ to address common questions about the CRA’s impact on open source projects. It is a living resources that evolves as new insights emerge and as discussions with regulators progress.",[419,420,423],"text-link",{"href":421,"weight":422,":new-tab":255},"https:\u002F\u002Fcra.orcwg.org","bold",[202,424,425],{},"Explore CRA FAQs",[196,427,428,432,435],{"variant":408,"spacing-bottom":409,"padding":199},[411,429,431],{"id":430},"european-commission-resources-for-implementation","European Commission Resources for Implementation",[202,433,434],{},"The European Commission provides official guidance and frequently asked questions on the implementation of the CRA. These resources covers a wide range of topics, including the scope of the regulation, obligations for manufacturers and software providers, reporting requirements, and the evolving implementation timeline. It also includes guidance relevant to the open source ecosystem, helping clarify how the CRA applies across the broader digital supply chain.",[419,436,438],{"href":437,"weight":422,":new-tab":255},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffactpages\u002Fcyber-resilience-act-implementation",[202,439,440],{},"Explore the EC’s CRA Resources",[196,442,443,447,450],{"variant":408,"padding":199},[411,444,446],{"id":445},"orc-learning-hub","ORC Learning Hub",[202,448,449],{},"With two introductory courses, ORC’s Learning Hub provides the first practical, open source-focused training to help you understand how the CRA applies in real-world scenarios and what actions you need to take.",[419,451,452],{"href":116,"weight":422},[202,453,454],{},"Start Learning",[394,456,457,482],{},[458,459,461,469,475],"grid",{"gap":460},"large",[462,463,466],"link-tile",{"href":464,"icon":465},"https:\u002F\u002Fwww.youtube.com\u002Fplaylist?list=PLy7t4z5SYNaQEyXv253SI6PDdPjbYXcNV","fa6-solid:chalkboard-user",[202,467,468],{},"Hear talks on the CRA",[462,470,472],{"href":104,"icon":471},"fa6-regular:calendar",[202,473,474],{},"Attend an event",[462,476,479],{"href":477,"icon":478},"https:\u002F\u002Forcwg.slack.com\u002Fjoin\u002Fshared_invite\u002Fzt-2y04e8mki-H~67CYr0CyogCnkPx2G~3Q","fa6-regular:comments",[202,480,481],{},"Join Slack",[237,483,484],{"v-slot:title":239},[202,485,486],{},"Join the Discussion",[394,488,489,513],{},[490,491,494],"newsroom-news",{"count":492,"date-style":493,"publish-target":11},"3","date-time",[237,495,496],{"v-slot:actions":239},[497,498,500,507],"stack",{"align":499},"between",[419,501,504],{"href":502,"icon":503},"https:\u002F\u002Fnewsroom.eclipse.org\u002Frss\u002Fnews\u002Forc\u002Fannouncements.xml","fa6-solid:rss",[202,505,506],{},"Subscribe",[419,508,510],{"href":509},"\u002Fnews\u002F",[202,511,512],{},"Visit news page",[237,514,515],{"v-slot:title":239},[202,516,517],{},"CRA News",[237,519,520],{"v-slot:eyebrow":239},[202,521,94],{},[237,523,524],{"v-slot:title":239},[202,525,526],{},"Connect, Learn & Stay Up to Date on the CRA",[196,528,530,535,538],{"variant":529,"spacing-bottom":460},"gradient",[531,532,534],"h2",{"id":533},"collaborate-with-us","Collaborate with us",[202,536,537],{},"The Open Regulatory Compliance (ORC) Working Group is a neutral forum for the open source community — including foundations, maintainers, vendors, users, package managers, among others — and the broader software industry to facilitate CRA compliance.",[497,539,540,547],{"align":211,"gap":460,"spacing-top":460},[541,542,544],"button-link",{":elevated":255,"href":78,"width":543},"fill",[202,545,546],{},"Join the working group",[541,548,549],{":elevated":255,"href":8,"width":543},[202,550,551],{},"Participate",[553,554],"deliverables-table",{},[556,557,558,610],"data-table",{},[559,560,561,574],"table",{},[562,563,564],"thead",{},[565,566,567,571],"tr",{},[568,569,570],"th",{},"Status",[568,572,573],{},"Meaning",[575,576,577,586,594,602],"tbody",{},[565,578,579,583],{},[580,581,582],"td",{},"🗺️ Planned",[580,584,585],{},"Work has not yet started",[565,587,588,591],{},[580,589,590],{},"✍️ Work in Progress",[580,592,593],{},"Currently being developed",[565,595,596,599],{},[580,597,598],{},"🚀 Shipped",[580,600,601],{},"Complete and available",[565,603,604,607],{},[580,605,606],{},"❌ Cancelled",[580,608,609],{},"Will not be completed",[237,611,612],{"v-slot:title":239},[202,613,614],{},"Status Legend",{"title":239,"searchDepth":616,"depth":616,"links":617},2,[618],{"id":533,"depth":616,"text":534},"CRA","hidden",null,"Learn how the EU Cyber Resilience Act (CRA) impacts open source software development. Understand key compliance requirements and what the CRA means for your project.","md",{"eyebrow":625,"headline":626,"tagline":627},"The European Union's Cyber Resilience Act","Getting Started With the CRA","Last updated: September 2026",{},"\u002Fcra",{"title":190,"description":622},"cra\u002Findex","large-headings","centered-padded","1LRUZ7wqLzcBnk4L5W695vc9-oAKkKXmt-GvBz1Z1xA",[],[637,641,645,650,654,658,662,666,670,674,678,682,686,690,694,699,703,707,711,715,720,725,729],{"path":638,"title":90,"number":639,"category":640,"status":590},"\u002Fcra\u002Fresources\u002Fd1-1-cra-faq","1.1","Documentation",{"path":642,"title":643,"number":644,"category":640,"status":590},"\u002Fcra\u002Fresources\u002Fd1-2-inventory","Inventory","1.2",{"path":646,"title":647,"number":648,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-1-input-to-draft-implementing-act-on-product-categories","Input to draft implementing act on product categories","2.1","Submissions",{"path":651,"title":652,"number":653,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-2-contribution-to-vulnerability-handling-standard-clause-44","Contribution to Vulnerability Handling Standard Clause 4.4","2.2",{"path":655,"title":656,"number":657,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-3-contribution-to-open-source-eu-guidance-on-open-source-hardware","Contribution to open source EU Guidance on open source hardware","2.3",{"path":659,"title":660,"number":661,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-5-comments-on-cencenelec-pt-1-standard","Comments on CEN\u002FCENELEC PT 1 Standard","2.5",{"path":663,"title":664,"number":665,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-6-feedback-on-cybersecurity-act-csa-revision","Feedback on Cybersecurity Act (CSA) Revision","2.6",{"path":667,"title":668,"number":669,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-7-comments-to-eu-guidance-on-open-source","Comments to EU Guidance on open source","2.7",{"path":671,"title":672,"number":673,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-8-response-to-the-call-for-evidence-on-the-revision-of-the-standardisation-regulation-1025","Response to the Call for evidence on the revision of the Standardisation Regulation 1025","2.8",{"path":675,"title":676,"number":677,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-9-comments-on-cencenelec-pt3-vulnerability-handling-standard","Comments on CEN\u002FCENELEC PT3 Vulnerability Handling Standard","2.9",{"path":679,"title":680,"number":681,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-10-contribution-to-the-call-for-evidence-of-the-open-digital-ecosystems","Contribution to the call for evidence of the Open Digital Ecosystems","2.10",{"path":683,"title":684,"number":685,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-11-contribution-to-the-call-for-feedback-of-the-cra-guidance-package","Contribution to the call for feedback of the CRA Guidance Package","2.11",{"path":687,"title":688,"number":689,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-12-contribution-to-enisa-secure-by-design-and-default-playbook-consultation","Contribution to ENISA Secure by Design and Default Playbook consultation","2.12",{"path":691,"title":692,"number":693,"category":649,"status":598},"\u002Fcra\u002Fresources\u002Fd2-13-contribution-to-the-call-for-feedback-of-the-cyber-security-act","Contribution to the call for feedback of the Cyber Security Act","2.13",{"path":695,"title":696,"number":697,"category":698,"status":582},"\u002Fcra\u002Fresources\u002Fd3-1-white-paper-on-sboms","White paper on SBOMs","3.1","White papers",{"path":700,"title":701,"number":702,"category":698,"status":590},"\u002Fcra\u002Fresources\u002Fd3-2-white-paper-on-due-diligence-obligation-of-manufacturers","White paper on due diligence obligation of manufacturers","3.2",{"path":704,"title":705,"number":706,"category":698,"status":582},"\u002Fcra\u002Fresources\u002Fd3-3-white-paper-on-security-attestations","White paper on security attestations","3.3",{"path":708,"title":709,"number":710,"category":698,"status":582},"\u002Fcra\u002Fresources\u002Fd3-4-white-paper-on-types-of-open-source-projects","White paper on types of open source projects","3.4",{"path":712,"title":713,"number":714,"category":698,"status":598},"\u002Fcra\u002Fresources\u002Fd3-5-white-paper-on-open-source-software-stewards-and-cra","White paper on open source software stewards and CRA","3.5",{"path":716,"title":717,"number":718,"category":719,"status":590},"\u002Fcra\u002Fresources\u002Fd4-1-vulnerability-management-specification","Vulnerability management specification","4.1","Specifications",{"path":721,"title":722,"number":723,"category":719,"status":724},"\u002Fcra\u002Fresources\u002Fd4-2-specification-on-principles-for-cyber-resilience-for-open-source-development","Specification on principles for cyber resilience for open source development","4.2","💡 Proposed",{"path":726,"title":727,"number":728,"category":719,"status":724},"\u002Fcra\u002Fresources\u002Fd4-3-specification-on-generic-security-requirements-for-open-source-components","Specification on generic security requirements for open source components","4.3",{"path":730,"title":731,"number":732,"category":719,"status":724},"\u002Fcra\u002Fresources\u002Fd4-4-security-policy-for-open-source-software-stewards","Security policy for open source software stewards","4.4",1792684539612]