Pathways to Cybersecurity Best Practices in Open Source

This technical report discusses the implications of the European Union's Cyber Resilience Act (CRA) on the open source ecosystem, particularly focusing on the roles of open source software stewards and the responsibilities they bear under the new regulatory framework. It outlines the CRA's requirements for cybersecurity in products with digital elements and emphasizes the need for collaboration between manufacturers and open source projects to ensure compliance. The report analyzes three significant projects—Civil Infrastructure Platform, Yocto Project, and Zephyr Project—highlighting their current security practices and readiness for CRA compliance. It also addresses challenges such as the lifecycle of industrial systems, standardization gaps in software bill of materials, and the evolving relationship between open source projects and commercial adopters. Furthermore, the report presents recommendations for adopting best practices in security management and emphasizes the importance of leadership in fostering a culture of cybersecurity within open source communities. Overall, the CRA is positioned as an opportunity to enhance cybersecurity practices across the digital landscape.