It focuses on how open source governance, community collaboration, and supply chain security practices can evolve to support compliance without undermining the openness and sustainability of OSS ecosystems.

We will discuss practical best practices for organizations and engineering teams, including compliant codebase management policies, vulnerability handling and disclosure, SBOM usage, and secure-by-design development workflows aligned with CRA requirements. The session also highlights how community-driven security processes such as coordinated disclosure, shared tooling, and upstream/downstream collaboration can become enablers rather than barriers under the new regulatory landscape.

By bridging regulatory expectations with community values, this talk aims to provide a pragmatic blueprint for sustaining healthy open source ecosystems while meeting the cybersecurity obligations introduced by CRA.

This talk:
• Emphasizes collaboration over compliance fear
• Frames CRA as a shared responsibility across ecosystems
• Addresses long-term sustainability, not just regulation

Key Topics Covered

• What CRA really says about OSS (and what it does not)
• The role of organizations owning OSS in CRA-era governance
• Open source supply chain security under CRA
• Best practices for:
    ○ OSS intake and reuse policies
    ○ Vulnerability disclosure and handling
    ○ SBOM generation and maintenance
    ○ Secure-by-design OSS development
• Aligning community practices with regulatory expectations
• Avoiding over-compliance that harms open collaboration

Suggested Audience

• Open source maintainers
• Security engineers working with OSS
• Compliance and governance teams
• Community managers
• Policy-curious developers

CRA does not regulate open source communities — it regulates how organizations collaborate with them. Good governance and strong communities are now a security feature.