Press release · September 10, 2026 · globenewswire.com
Eclipse Foundation Releases Free OCCTET Toolkit for EU CRA Preparation
Summary
The Eclipse Foundation made a free, open source OCCTET toolkit available to help organizations prepare for the European Union’s Cyber Resilience Act (CRA) and support documentation needs ahead of the CRA’s first reporting deadline.
The release arrived as the CRA’s first obligations took effect in stages, with manufacturers required to report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements starting 11 September 2026. Broader CRA requirements were scheduled to apply from 11 December 2027.
The OCCTET toolkit translated CRA requirements into structured steps for software development and security processes. It supported readiness assessment, identification of open source components used in products, vulnerability handling, and documentation of how security risks were addressed.
Mike Milinkovich, executive director of the Eclipse Foundation, said, “OCCTET makes that work more manageable by bringing together tools that help them understand their obligations, identify and address vulnerabilities, and maintain the records needed to support compliance.” The toolkit combined services including a CRA Self-Assessment Portal, Eclipse Apoapsis for component, dependency, and license identification with SBOM generation, Bitsea Curator for verifying software information and producing Vulnerability Exploitability eXchange (VEX) reports, and vulnerablecode.io and its PurlDB demonstrator and VulnerableCode integration for package and vulnerability data.
Forward-looking statements were not included in the provided text.
Our summary. The original keeps its own byline.