=== Cyber Resilience Act (CRA) Readiness Project

Links: +
link:https://github.com/FreeBSDFoundation/all-projects/tree/main/Cyber%20Resilience%20Act%20Readiness[Cyber Resilience Act Readiness] URL: link:https://github.com/FreeBSDFoundation/all-projects/tree/main/Cyber%20Resilience%20Act%20Readiness[]

The Foundation is running a project through 2026 to actively prepare the FreeBSD Foundation, Project, and the community for the EU Cyber Resilience Act.
There are six main areas of focus: Security and Vulnerability Handling, SBOM Toolchain, Public Documentation, Community Legislative Engagement, Public Project Repository, and Communications.

Over Q2 the project has made significant progress on its key goals.

Security efforts have focused on improving vulnerability handling and supply chain readiness through discussions with downstream vendors about reporting processes, Software Bill of Materials (SBOM) usage, and potential funding for compliance work.

The Foundation has also strengthened collaboration with the wider open source ecosystem by participating in Open Regulatory Compliance and OpenSSF activities, joining the OpenSSF as an associate member, attending Open Source Summit North America, and engaging with projects such as Zephyr to share CRA readiness strategies.

The SBOM toolchain work has advanced significantly and is now close to full end-to-end functionality.
We plan to publish a technical blog once the remaining work is complete.

The Foundation also created draft CRA guidance for the FreeBSD community and we plan to publish this along with a dedicated section of the Foundation website providing permanent compliance information.

Transparency remained a priority, and the Foundation has published monthly public updates and meeting minutes on the repo linked above.
There will be a full day CRA and SBOM tutorial at EuroBSDCon, which we invite you to attend!
