In a landmark move towards bolstering cybersecurity standards in Europe, seven prominent open source foundations have joined hands to forge common specifications and standards crucial for the implementation of the Cyber Resilience Act (CRA). This pivotal regulation, recently adopted by the European Parliament, aims to set rigorous cybersecurity protocols for all internet-connected products across the European Union.

The collaboration involves esteemed entities such as The Apache Software Foundation, Blender Foundation, Eclipse Foundation, OpenSSL Software Foundation, PHP Foundation, Python Software Foundation, and Rust Foundation. Together, they pledge to harness their collective expertise to bridge existing security practices in open source software development and fortify the software supply chain.

At the heart of the initiative lies the recognition of the overwhelming presence of open source components in modern software, comprising up to 90% of the software ecosystem. The CRA mandates manufacturers to stay abreast of the latest security updates or face substantial penalties, emphasizing the critical role of robust cybersecurity frameworks.

Initially met with skepticism, the CRA faced concerns from various quarters, including the open source community. However, through iterative revisions, the legislation now incorporates provisions safeguarding open source projects and delineating the role of “open source stewards,” including not-for-profit foundations.

Mike Milinkovich, Executive Director of the Eclipse Foundation, lauds the regulation for recognizing the pivotal role played by foundations and community stewards in the software supply chain. He underscores the significance of the legislation, marking a pioneering effort in regulating the software industry comprehensively.

With the CRA slated to take effect in 2027, the collaborative efforts of the open source foundations assume paramount importance. The focus now shifts to harmonizing documentation standards, addressing patchy documentation prevalent in many open source projects, and fostering alignment among diverse methodologies and terminologies.

This landmark collaboration, spearheaded by the Eclipse Foundation, sets the stage for standardized cybersecurity processes within the open source community and the broader software industry. As regulatory scrutiny intensifies worldwide, the collective endeavor aims to navigate the evolving landscape of cybersecurity legislation while championing innovation and security in software development.