# cyber resilience act The Cyber Resilience Act (CRA) is an EU regulatory framework establishing cybersecurity requirements for hardware and software products with digital elements placed on the Union market. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Announcing the Sovereign Artifacts beta DevFeed: [Announcing the Sovereign Artifacts beta]() Original publisher: [Read original article]() Published: 2026-09-15T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Open Source](), [Software](), [cyber resilience act](), [Resilience]() Tags: [chainguard](), [container](), [cyber-resilience-act](), [eu](), [infrastructure](), [network](), [open-source](), [performance](), [resilience](), [supply-chain]() ### AI overview Chainguard has launched Sovereign Artifacts in beta, providing EU-local storage and delivery for secure container and library artifact bytes. Phase 1 stores artifacts in the EU, while authentication and build pipelines remain hosted in the United States. The service is intended to support sovereignty and data-residency requirements and reduce artifact pull times for European customers. ### Source excerpt Chainguard launches Sovereign Artifacts in beta, giving global organizations an EU-local option for secure container and library artifacts. ## How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act DevFeed: [How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act]() Original publisher: [Read original article]() Author: andrewb@proximabiz.com (The Linux Foundation) Published: 2026-09-09T19:11:24Z Content type: article Language: en Sources: [Linux Foundation - Blog]() Topics: [cyber resilience act](), [Security](), [Vulnerabilities](), [open-source-security](), [supply-chain-security]() Tags: [2026](), [cyber-resilience-act](), [eu](), [linux-foundation](), [open-source](), [openssf](), [regulatory](), [security](), [supply-chain-security](), [vulnerabilities]() ### AI overview This Linux Foundation post explains how Open Source Program Offices can help organizations prepare for the EU Cyber Resilience Act, including identifying affected products and dependencies, coordinating legal, security, engineering and procurement teams, and responding to vulnerability and incident reporting obligations. ### Source excerpt For organizations offering products with digital elements in the EU, the next major Cyber Resilience Act (CRA) deadline arrives on 11 September 2026. From that date, organizations covered by the reporting obligations must be ready to assess actively exploited vulnerabilities and severe security incidents, coordinate an internal response and submit notifications within the required timelines. ## EU Cyber Resilience Act: Vulnerability Reporting Obligations DevFeed: [EU Cyber Resilience Act: Vulnerability Reporting Obligations]() Original publisher: [Read original article]() Author: John Lee Published: 2026-09-09T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [cyber resilience act](), [Vulnerabilities](), [Espressif](), [ESP32](), [ESP-IDF](), [Security](), [EN 18031]() Tags: [blog](), [cyber-resilience-act](), [en-18031](), [esp-idf](), [esp32](), [espressif](), [eu](), [iot](), [security](), [vulnerability]() ### AI overview This article explains that the Cyber Resilience Act's vulnerability-reporting obligations begin on 11 September 2026 for connected products sold in the EU, including products already on the market. It outlines Article 14 duties, reporting recipients and the role of Espressif's platform layer for products built on ESP32. ### Source excerpt The CRA's vulnerability reporting obligations start on 11 September 2026 and apply to products already on the market, including ones sold years ago. What Article 14 requires, which duties run to whom, how reporting works through the ENISA Single Reporting Platform, and where the Espressif platform layer fits. ## How Teleport Operationalizes the EU Cyber Resilience Act's Secure-by-Design Mandate DevFeed: [How Teleport Operationalizes the EU Cyber Resilience Act's Secure-by-Design Mandate]() Original publisher: [Read original article]() Author: info@goteleport.com (Maximilian Heck, Waldemar Kindler) Published: 2026-07-16T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [cyber resilience act](), [Security](), [Architecture & Design](), [Authentication](), [Encryption](), [audit trail](), [Monitoring & Alerting]() Tags: [audit-trail](), [authentication](), [cra-requirements](), [cryptographic](), [cyber-resilience-act](), [eu](), [monitoring-alerting](), [secure-by-design](), [security]() ### AI overview The article explains how Teleport maps its infrastructure identity, access, policy, logging, monitoring, and audit controls to ENISA's Secure by Design and Default Playbook and the EU Cyber Resilience Act. It highlights cryptographic identity, least privilege, secure communication, supply-chain controls, and default protection of device identities and secrets. ### Source excerpt See how Teleport features map to ENISA's Secure-by-Design specification for CRA. ## CTRL-OS 26.05 Released! DevFeed: [CTRL-OS 26.05 Released!]() Original publisher: [Read original article]() Author: blitz Published: 2026-07-10T12:35:43Z Content type: release Language: en Sources: [Announcements - NixOS Discourse]() Topics: [Nix](), [Linux](), [maintenance](), [Security](), [cyber resilience act]() Tags: [announcements](), [cyber-resilience-act](), [infrastructure](), [linux](), [maintenance](), [release](), [sboms](), [security]() ### AI overview CTRL-OS 26.05, a downstream distribution of NixOS, has been released. The release provides a five-year lifecycle model, beginning with co-maintenance while NixOS has community support and moving to stability maintenance afterward. CTRL-OS monitors and backports security fixes for a core package set, with commercial subscriptions supporting SLAs and custom package sets. The project also describes its role in helping embedded Linux products address long-term vulnerability patching and EU Cyber Resilience Act requirements. ### Source excerpt Welcome to the latest CTRL-OS update! Find the last update from April here. If you don't know yet, CTRL-OS is a downstream distribution of NixOS designed to extend the release lifecycle to 5 years. It gives you a stable foundation with commercial support so you can build your products without having to maintain the packages you depend on. CTRL-OS 26.05 Released! The CTRL-OS 26.05 release is finally out. You can find the release blog post on our website. Or head over to our technical documentation and try it out. As long as NixOS 26.05 has community support, CTRL-OS 26.05 will be in the co-maintenance phase. In this phase, we will monitor our supported package set and contribute any security fixes back to NixOS. After community support ends, we enter the stability phase, and maintenance shifts completely to us. We've detailed this model on our blog. As of now, we support a small but useful package set. We'll share more details here soon, but our goal is to cover the usual packages you deploy on a server or embedded system, i.e., that dusty plastic box in the corner that quietly does its job for years. We actively monitor and backport CVEs for a core set of packages. To fund this work, commercial subscriptions provide SLA guarantees and cover custom package sets. While we aim to stay very close to NixOS 26.05, we will pull in important security fixes quickly to keep our SLAs. This creates a divergence that will automatically resolve itself once the security fixes make it to the NixOS release branch as well. Finally, to avoid a maintenance burden for the community, our CTRL-OS 26.05 release is lightly branded. By making it easy to identify a CTRL-OS system via nix-env -m, we ensure that bug reports originating from CTRL-OS users don't accidentally get filed against upstream NixOS, respecting the time and effort of upstream maintainers. No Cyber Resilience Act (CRA) Worries With the EU's CRA requirements taking effect this September, shipping embedded Linux products is ## How to Meet EU Cyber Resilience Act (CRA) Requirements DevFeed: [How to Meet EU Cyber Resilience Act (CRA) Requirements]() Original publisher: [Read original article]() Author: info@goteleport.com (Maximilian Heck, Waldemar Kindler) Published: 2026-07-01T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [cyber resilience act](), [Requirements](), [Security](), [audit trail](), [Encryption]() Tags: [audit-trail](), [ci-cd](), [compliance](), [cyber-resilience-act](), [cybersecurity](), [encryption](), [eu](), [how-to](), [requirements]() ### AI overview This tutorial explains how identity, access, encryption, and audit controls relate to EU Cyber Resilience Act requirements. It also discusses fragmented security toolchains, a compromised Trivy release, and infrastructure patterns such as short-lived cryptographic identities, hardware-rooted device trust, and unified audit trails. ### Source excerpt Learn how to implement identity, access, and audit controls that meet EU Cyber Resilience Act compliance requirements. ## Understanding the EU Cyber Resilience Act (CRA) DevFeed: [Understanding the EU Cyber Resilience Act (CRA)]() Original publisher: [Read original article]() Author: John Lee Published: 2026-03-16T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [cyber resilience act](), [Cybersecurity](), [ESP32](), [Embedded Systems](), [Espressif](), [Software]() Tags: [blog](), [cra-requirements](), [cyber-resilience-act](), [cybersecurity](), [digital-products](), [embedded-systems](), [esp-idf](), [esp32](), [espressif](), [eu](), [iot](), [security]() ### AI overview This article explains how the EU Cyber Resilience Act applies to ESP32-based digital products, including connected devices, embedded systems, firmware, companion applications, and related cloud offerings. It outlines the CRA timeline, including vulnerability reporting obligations from September 2026 and core requirements from December 2027, and discusses compliance considerations for OEM manufacturers. ### Source excerpt The EU Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements placed on the EU market. This blog outlines what the CRA means for ESP32-based products, the obligations for OEM manufacturers, and how Espressif will support customers in achieving compliance. ## Staying Ahead with ESP32 Security Updates DevFeed: [Staying Ahead with ESP32 Security Updates]() Original publisher: [Read original article]() Author: John Lee Published: 2026-03-05T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [ESP32](), [Security](), [vulnerability management](), [cyber resilience act](), [dashboards](), [ESP-IDF](), [Espressif](), [software bill of materials]() Tags: [blog](), [cyber-resilience-act](), [dashboards](), [esp-idf](), [esp32](), [espressif](), [iot](), [lts](), [ota](), [sbom](), [security](), [vulnerability]() ### AI overview This article explains how the ESP32 ecosystem supports long-term firmware security and compliance under regulations such as the EU Cyber Resilience Act. It covers vulnerability management, secure OTA updates, Long-Term Support branches, the ESP-IDF Security Dashboard, and SBOMs for tracking affected components and patched versions. ### Source excerpt This article explains how manufacturers can use the ESP32 ecosystem to build and maintain secure firmware over time, especially in light of new regulations like the EU Cyber Resilience Act. It highlights tools such as vulnerability dashboards, Long-Term Support branches, and secure OTA updates to ensure ongoing compliance and device security. ## Understanding the EU's Cyber Resilience Act (CRA) DevFeed: [Understanding the EU's Cyber Resilience Act (CRA)]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-01-22T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [cyber resilience act](), [supply-chain-security](), [Security](), [sdlc](), [Application Security](), [snyk]() Tags: [awareness](), [blog](), [compliance](), [cyber-resilience-act](), [eu](), [executive](), [megawatt](), [sast](), [sbom](), [sca](), [sdlc](), [secure-by-design](), [security](), [snyk](), [software-supply-chain-security](), [supply-chain-security]() ### AI overview The article explains how the EU Cyber Resilience Act (CRA) establishes cybersecurity requirements for products with digital elements. It discusses secure-by-design practices, vulnerability handling throughout the product lifecycle, upcoming reporting and compliance deadlines, and the role of SAST, SCA, and software supply chain security. ### Source excerpt Find out how the Cyber Resilience Act (CRA) sets new security standards for the EU and how Snyk can help simplify compliance with its developer-friendly tools. ## EU CRA: What does it mean for open source? DevFeed: [EU CRA: What does it mean for open source?]() Original publisher: [Read original article]() Published: 2023-12-30T09:56:56Z Content type: opinion Language: en Sources: [Bert Hubert's writings]() Topics: [cyber resilience act](), [Open Source](), [Resilience](), [Computing]() Tags: [compliance](), [cyber-resilience-act](), [eclipse-foundation](), [eu](), [europe](), [legal](), [open-source](), [regulatory](), [resilience](), [rules](), [security](), [software](), [standards]() ### AI overview This opinion examines the final compromise text of the EU Cyber Resilience Act and its implications for open-source software. It discusses community concerns about applying the act's development, testing, auditing, and support requirements to open-source projects, while arguing that some criticism of the final text is unfounded. ### Source excerpt The final compromise text of the EU Cyber Resilience Act is now officially available, and various open source voices are currently opining on it. This is a complex act and other parts of the open source world (like the Eclipse Foundation and NLNet Labs) have been hard at work to advocate with the EU and member states to get a CRA that is good for open source. I've also been highly critical. ## EU CRA: The compiler does not read the comments, but judges do read the Recitals DevFeed: [EU CRA: The compiler does not read the comments, but judges do read the Recitals]() Original publisher: [Read original article]() Published: 2023-12-29T18:56:56Z Content type: opinion Language: en Sources: [Bert Hubert's writings]() Topics: [cyber resilience act](), [Open Source]() Tags: [cyber-resilience-act](), [eclipse-foundation](), [eu](), [europe](), [legal](), [open-source]() ### AI overview This emergency blog post discusses the final compromise text of the EU Cyber Resilience Act and argues that it mostly excludes open-source authors and programmers from its effects. It explains that the relevant provisions appear largely in the act's recitals and addresses possible misinterpretations of those provisions. ### Source excerpt A bit of an "emergency blog post". The final compromise text of the EU Cyber Resilience Act is now available, and various open source voices are now opining on it. This is a complex act and other parts of the open source world (like the Eclipse Foundation and NLNet Labs) have been hard at work to advocate with the EU and member states to get a CRA that is good for open source. ## EU CRA and the Open Source Ecosystem: A Suggestion DevFeed: [EU CRA and the Open Source Ecosystem: A Suggestion]() Original publisher: [Read original article]() Published: 2023-11-12T13:22:46Z Content type: opinion Language: en Sources: [Bert Hubert's writings]() Topics: [cyber resilience act](), [Open Source](), [Security]() Tags: [cyber-resilience-act](), [eu](), [europe](), [legal](), [open-source](), [security]() ### AI overview This commentary examines how the EU Cyber Resilience Act could affect open source projects and the broader open source ecosystem. It argues that commercial manufacturers relying on open source components should invest in their security, while regulation should avoid imposing compliance departments on individual open source developers. An update says a later agreed version of the Act appears to have addressed the concerns, making much of the original discussion historical. ### Source excerpt UPDATE: On December 1st the EU agreed on a version of the Cyber Resilience Act that appears to have substantially addressed the concerns in the post below. Further analysis awaits, but do know that the text that follows is now mostly of historical interest! UPDATE 2: Here is the final compromise text of the Cyber Resilience Act. UPDATE 3: Here is an analysis of what it means for open source. ## Build affordable Secure connected devices with ESP32-H2 DevFeed: [Build affordable Secure connected devices with ESP32-H2]() Original publisher: [Read original article]() Author: John Lee Published: 2023-05-11T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [ESP32](), [Security](), [Espressif](), [Hardware](), [cyber resilience act]() Tags: [blog](), [connectivity](), [ecdsa](), [embedded-systems](), [encryption](), [esp32](), [esp32-h2](), [espressif](), [flash-encryption](), [hardware](), [matter](), [mcu](), [rsa](), [secure-boot](), [security]() ### AI overview This article explains the ESP32-H2's hardware and software security features for connected devices, including Secure Boot, flash encryption, debug-interface protection, secure storage, memory protection, and device identity protection. It also describes RSA-PSS and ECDSA verification options, public-key storage and revocation, and the encryption of off-chip flash memory. ### Source excerpt The awareness, as well as the associated concerns, about connected device security, is ever-increasing. With the European Union's Cyber Resilience Act also coming into effect soon, it has become ever so important to have security features built-in to the devices in hardware. The Espressif ESP32-H2 has been built to provide an affordable security solution to all and thus integrates a variety of security features. ## EU Cyber Resilience Act part two: Updates & Impracticalities DevFeed: [EU Cyber Resilience Act part two: Updates & Impracticalities]() Original publisher: [Read original article]() Published: 2023-03-23T15:51:39Z Content type: opinion Language: en Sources: [Bert Hubert's writings]() Topics: [cyber resilience act](), [Resilience](), [Cybersecurity](), [Software](), [Hardware](), [Linux Kernel](), [Firewall]() Tags: [cyber-resilience-act](), [cybersecurity](), [eu](), [firewall](), [hardware](), [linux](), [linux-kernel](), [politics](), [programming](), [security]() ### AI overview This follow-up commentary examines practical questions about how the EU Cyber Resilience Act might work, focusing on third-party components in hardware and software products. It discusses concerns about regulatory workability and possible effects on innovation, while noting the draft's due-diligence expectations for manufacturers. ### Source excerpt This is a living document - I'd normally spend a few days polishing everything, but since CRA talks are ongoing right now, there's simply no time for that. Check back frequently for updates! Also please let me know urgently on bert@hubertnet.nl if you think I'm reading things incorrectly! As a follow-up to my earlier post on the EU Cyber Resilience Act, here I'd like to address some practicalities: how would it actually work. ## How the EU Cyber Resilience Act would set cybersecurity requirements for software and connected products DevFeed: [How the EU Cyber Resilience Act would set cybersecurity requirements for software and connected products]() Original publisher: [Read original article]() Published: 2023-03-14T08:13:10Z Content type: opinion Language: en Sources: [Bert Hubert's writings]() Topics: [cyber resilience act](), [Cybersecurity](), [Security](), [Code](), [Requirements](), [Software]() Tags: [business](), [chrome](), [code](), [cyber-resilience-act](), [cybersecurity](), [eu](), [europe](), [firefox](), [firewalls](), [hardware](), [innovation](), [linux](), [microcontrollers](), [public-key](), [requirements]() ### AI overview This commentary examines the EU Cyber Resilience Act (CRA), which would establish essential cybersecurity requirements for nearly all software and hardware with digital elements distributed in Europe. It discusses proposed secure-coding standards, third-party audits for certain critical products, and potential fines for non-adherence. ### Source excerpt First a round of thanks for the many people in industry and government who provided valuable links, background and insights! I could not have done this without your help! If you spot any mistakes, or have suggestions, please do contact me on bert@hubertnet.nl The EU's new Cyber Resilience Act is admirable in its goal. And the EU is not alone in thinking something needs to be done about the dreadful state of security online - the Biden administration has just released its National Cybersecurity Strategy that has similar aims.