Eclipse Foundation and OWASP Sign MoU for CRA Readiness
The Eclipse Foundation and the OWASP Foundation entered a Memorandum of Understanding to work together on open source security and to support readiness for the European Union’s Cyber Resilience Act. The collaboration focused on helping organizations address regulatory requirements tied to products with digital elements made available in the EU.
The MoU combined Eclipse Foundation open source governance and regulatory readiness with OWASP’s security projects, standards, education, and community. The organizations planned to develop resources aimed at open source maintainers, stewards, manufacturers, and software teams, with a focus on strengthening security practices and responding to evolving regulatory requirements.
The EU Cyber Resilience Act created mandatory cybersecurity requirements for products with digital elements made available in the EU, including products built with or dependent on open source software. The regulation also introduced vulnerability and incident reporting obligations for manufacturers that take effect on 11 September 2026, along with recognition for open source software stewards as important participants, with responsibilities that differ from those of commercial manufacturers.
Under the MoU, the organizations said they intended to collaborate across five areas: CRA readiness for the open source ecosystem; alignment and interoperability among security practices and frameworks; joint education and community engagement; open source stewardship and maintainer support; and policy and regulatory education. Initial priorities were expected to include practical guidance for open source stewards, joint CRA readiness webinars, resources supporting software bill of materials adoption, and software supply chain security, alongside community events, workshops, and maintainer roundtables. “Open source is critical digital infrastructure, but responsibility for securing it is distributed across a complex global ecosystem,” said Mike Milinkovich, executive director of the Eclipse Foundation. “Security guidance only makes a difference when developers, maintainers, and organisations can put it into practice,” said Andrew van der Stock, executive director of the OWASP Foundation. “Security guidance only makes a difference when developers, maintainers, and organisations can put it into practice,” said Andrew van der Stock, executive director of the OWASP Foundation.
Provided by Globe Newswire on behalf of Eclipse Foundation. Click to read original content. The original article was written by Decision Insights Editorial.