Open Source Compliance Comprehensive tools and resources designed to simplify and streamline the CRA compliance process for SME, allowing them to tackle the complexities of OSS compliance.

ongoing

Open Source Software (OSS) plays a critical role in the development and deployment of products with digital components. No manufacturer builds their products from scratch; instead, they leverage, build upon, and incorporate third-party dependencies to expedite development and reduce time to market. Up to 99.9% of these dependencies are open source components. The Cyber Resilience Act, specifically Article 10(4), mandates that manufacturers ensure any third-party components integrated into their products do not compromise the cybersecurity of those products, including free and open-source software components. This requirement implies that manufacturers must meticulously identify and evaluate all the OSS components they depend on. For small and medium-sized enterprises (SMEs), this task is particularly daunting due to the complex and extensive nature of dependency trees in modern digital products. Our proposal seeks to address this challenge head-on by developing an OSS Compliance Toolkit designed to simplify and streamline the compliance process for SMEs. This toolkit, to be released under an open-source licence and thus freely available, is intended to provide a comprehensive suite of tools and resources tailored to the needs of SMEs navigating the complexities of OSS compliance. The toolkit will encompass several critical components: - Compliance Checklist - Conformity Assessment Specifications: - Automated Evaluation Method and Tool: - Federated Database platform for publishing the results of OSS component assessments allowing contributions from various stakeholders - Inventory of Automatic Dependency Analysis Tools: - Reporting tool