The OCCTET Project – Open Source Compliance: Comprehensive Techniques and Essential Tools – brings together a consortium of industry leaders, cybersecurity experts, and open source advocates to create free and open source tools that make compliance more accessible, transparent, and cost-effective.
“CRA compliance is a multi-year process that organizations need to prioritize now,” says Mike Milinkovich, executive director of the Eclipse Foundation. “Even companies that understand the urgency often lack the internal expertise to make this process happen. OCCTET is designed to make the path to compliance as easy as possible and complements our broader efforts to ensure the open source community has the resources it needs to thrive in this new regulatory landscape.”
The Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for all digital products, including software, sold in the EU. It applies to manufacturers, software vendors, and maintainers, and mandates the adoption of secure development practices and the transparent management of vulnerabilities across their entire software supply chain. The CRA came into effect in December 2024, and organizations now face a tight deadline to meet the new requirements before they take full force.
Open source software, estimated to be present in up to 96% of all commercial software (Harvard Business School, March 2025), further complicates compliance efforts, as it is typically developed and maintained by decentralized communities rather than being controlled by a single vendor.
OCCTET addresses these challenges by offering open and collaborative solutions that reduce the complexity and cost of CRA compliance, enabling SMEs to focus on innovation without sacrificing security.
The OCCTET toolkit will provide a comprehensive set of resources tailored to the needs of SMEs, including:
● CRA compliance checklist
● Conformity assessment specifications
● Automated assessment methods and tools
● A federated database platform for publishing OSS component assessments, enabling multi-stakeholder input
● Inventories of automated dependency analysis tools
● A reporting tool for creating documentation and evidence
More information
The Eclipse Foundation is also driving other CRA-focused initiatives, such as the ORC – Open Regulatory Compliance Working Group, which is actively developing community-driven resources and specifications to support CRA implementation in open source ecosystems.
