Navigating the Maze of Cyber Resilience Act Compliance: How the OCCTET Project Empowers SMEs and Open Source

The European Union’s Cyber Resilience Act (CRA) marks a new era in digital product security, introducing sweeping mandates for manufacturers and software vendors. For small to medium-sized enterprises (SMEs) and the open source community, achieving Cyber Resilience Act compliance can seem like a daunting, resource-intensive challenge. This article explores how the Eclipse Foundation’s OCCTET project provides a crucial, open-source lifeline for navigating this complex regulatory landscape.

The New Regulatory Horizon: Understanding the Cyber Resilience Act

In force since December 2024, the Cyber Resilience Act (CRA) is a landmark piece of EU legislation designed to bolster the cybersecurity of all digital products sold within its market. Its scope is vast, covering everything from smart home devices and industrial controllers to standalone software. The core mandate of the CRA is to shift the responsibility for cybersecurity from the end-user to the manufacturer. This introduces significant new obligations for developers, vendors, and maintainers.

Key requirements under the CRA include:

• Secure by Design: Products must be developed with security as a foundational principle throughout their entire lifecycle.
• Vulnerability Management: Manufacturers are required to have robust processes for identifying, reporting, and patching security vulnerabilities.
• Transparency: Vendors must provide clear and comprehensive cybersecurity information to consumers, including details about the software components used (a Software Bill of Materials or SBOM).
• Support Lifecycle: Security support, including patches and updates, must be provided for an expected product lifetime or a minimum of five years.

While these goals are laudable, they present major regulatory hurdles, especially for organizations without dedicated legal or compliance teams. SMEs, which constitute a significant portion of the EU’s digital economy and heavily rely on open source software, face a particularly steep climb. The open source ecosystem, built on distributed and often voluntary contributions, faces unique challenges in meeting formal attestation and documentation requirements. With mandatory compliance deadlines approaching in late 2025, the need for accessible, low-burden solutions has never been more critical.

Introducing the OCCTET Project: A Beacon for Cyber Resilience Act Compliance

In response to these challenges, the Eclipse Foundation has launched the Open Source Compliance, Conformance, and Tooling for the European Cyber Resilience Act (OCCTET) project. This EU-funded initiative is specifically engineered to demystify and streamline the path to Cyber Resilience Act compliance for SMEs and open source software stakeholders. It provides a free, open-source toolkit designed to automate and simplify the complex processes involved in meeting the new regulations.

“Compliance with the CRA is a multi-year journey that organisations need to prioritise now… OCCTET is designed to make the path to compliance as easy as possible, and it complements our broader efforts to ensure the open source community has the resources it needs to thrive under this new regulatory landscape.”

– Mike Milinkovich, Executive Director, Eclipse Foundation

The OCCTET toolkit is not a single application but a comprehensive suite of resources aimed at various stages of the compliance lifecycle. According to the official announcement, its core components provide tangible support for organizations navigating their compliance journey.

Key Features of the OCCTET Toolkit

The project focuses on delivering practical, actionable tools that reduce manual effort and provide clear guidance. These include:

• Automated Compliance Checklists: Interactive checklists that guide users through the CRA’s requirements, helping them identify gaps and track progress toward conformity.
• Evaluation and Assessment Tools: Software to analyze products and development processes against CRA standards, automating parts of the risk assessment phase.
• Conformity Specifications: Standardized templates and specifications to help organizations produce the necessary documentation and attestations required by regulators.
• Dependency Analysis: Advanced tools to scan software projects for open source dependencies, identify their licenses, and flag known vulnerabilities, which is crucial for creating accurate SBOMs.
• Reporting Platforms: Integrated platforms to generate, manage, and share compliance reports and documentation with stakeholders and regulatory bodies.

By making these resources open source, the OCCTET project ensures they are not only free to use but also transparent and extensible, allowing the community to adapt and improve them over time.

The Power of Collaboration: The Open Regulatory Compliance (ORC) Working Group

The OCCTET project does not operate in a vacuum. It is complemented and strengthened by the Open Regulatory Compliance (ORC) Working Group, another Eclipse Foundation initiative. The ORC brings together a powerful consortium of industry leaders, including Microsoft, Red Hat, Google, and GitHub, alongside hundreds of other organizations, to develop shared resources and best practices for regulatory readiness.

The ORC’s mission is to create a common ground for understanding and implementing cybersecurity regulations. As detailed in a recent working group announcement, its initial deliverables include dozens of best practices and specifications that cover a wide range of domains relevant to the CRA.

“The ORC community is delivering exactly what the industry needs right now: practical resources to help organisations that rely on open source better understand and prepare for the Cyber Resilience Act… It helps demystify compliance and showcases how open source stakeholders are addressing cybersecurity regulation in meaningful ways.”

– Mike Milinkovich, on the ORC Working Group

The collaboration between OCCTET and the ORC is symbiotic. The ORC develops the high-level inventories, best practices, and specifications, while OCCTET provides the open-source tooling to implement them. This dual approach ensures that the path to compliance is supported by both strategic guidance and practical, hands-on tools. This addresses a core concern within the developer community.

“Most open source developers, even those working full time on open source projects, simply don’t have the capacity to manage the full burden of cyber security compliance. That’s why open source stewards… are stepping up to ensure that compliance processes are as low impact as possible for open source projects.”

– ORC Working Group Statement, via Electronics Specifier

Practical Application: How OCCTET and ORC Drive Real-World Cyber Resilience Act Compliance

The true value of these initiatives lies in their real-world application. By providing concrete tools and frameworks, OCCTET and ORC are already enabling organizations across various sectors to prepare for the CRA. The emphasis is on producing formal attestations and maintaining clear stewardship responsibility through community-led resources, as discussed during the Code & Compliance Community Day.

Use Cases Across Industries

• SMEs and IoT Devices: A small Internet of Things (IoT) company developing a smart home product can use OCCTET’s dependency analysis tools to automatically scan the open source components in its firmware. The automated checklists help its small development team conduct a self-assessment against CRA requirements, generating the necessary documentation for CE marking without hiring expensive consultants.
• Automotive Sector: With modern vehicles containing millions of lines of code, automotive manufacturers face immense supply chain complexity. These companies participate in ORC-led workshops to standardize how they produce and consume attestations for software components, ensuring every part of their digital supply chain meets CRA standards.
• Healthcare Technology: A provider of medical devices that uses third-party software can leverage the OCCTET and ORC databases to assess vulnerabilities in its software stack. This helps accelerate regulatory certification by providing a transparent and verifiable record of its due diligence, a critical requirement in the safety-critical healthcare sector.
• Open Source Foundations: Organizations like Open Source Matters (the foundation behind Joomla!) and ekxide are adopting ORC’s deliverables to create standardized compliance practices across their projects. This helps their vast communities of contributors understand their roles and responsibilities under the new regulatory framework.

A prime example of collaborative compliance is the partnership between Double Open and OCCTET, where one partner focuses on automated analysis while others handle documentation and reporting, creating an end-to-end compliance workflow across the supply chain.

Key Considerations and the Path Forward

A crucial aspect of the CRA, and a point of relief for many developers, is its explicit exclusion of certain open source activities. As clarified in analysis by publications like Electronics Specifier, the CRA does not apply to non-commercial, non-marketed open source software or individual volunteer developers. The act targets software “placed on the market,” meaning the compliance obligation generally falls on the commercial entity that integrates and sells a product containing open source components.

This distinction is vital, as it allows the open source ecosystem to continue innovating without placing an undue legal burden on individual contributors. The broader strategy of the Eclipse Foundation and its partners is to keep the compliance process as low-impact as possible for the open source community while promoting clear guidance and standards for the commercial entities that rely on it.

The market impact is undeniable. SMEs represent the vast majority of digital product vendors in the EU, and industry estimates suggest that up to 87% of these companies implement open source solutions. The OCCTET project is tailored for this demographic, providing the scale and accessibility needed to support an entire economic sector’s transition to a more secure digital future.

Conclusion

The EU’s Cyber Resilience Act represents a fundamental shift in cybersecurity responsibility, but it does not have to be an insurmountable obstacle. Through collaborative, open-source initiatives like the OCCTET project and the Open Regulatory Compliance Working Group, the Eclipse Foundation is building the bridges needed for a smooth transition. These efforts provide the tools, guidance, and community support necessary for achieving Cyber Resilience Act compliance.

Explore the OCCTET project toolkit to see how its resources can benefit your organization, or consider getting involved with the ORC Working Group to help shape the future of open source regulatory compliance. Share this article to help spread awareness of these vital resources.