Cyber Resilience Act

SBOMs, as they're abbreviated, are used as inputs for SCA tools such as scanners for vulnerabilities and licenses, and have been gaining traction in global software regulations and frameworks.

SBOMs are required by recent software security regulations like the Secure Software Development Framework and the Cyber Resilience Act.

770 was accepted in April last year.

I won't dive too much further into all the specifics of it, of the PEP, but it's w- well written and definitely something you might wanna look into.

Top story number two.

The EU Cyber Resilience Act is tightening reporting requirements for manufacturers of connected products, requiring them to disclose actively exploited vulnerabilities and severe incidents within strict timeframes.

The rules are designed to improve transparency and speed up response across the software supply chain, but they also raise compliance pressure for vendors selling into the European market.

For executives, the measure signals a shift from voluntary disclosure to mandatory cyber incident reporting with significant operational and legal consequences.

But knowing that cybersecurity is going to be a law, if not in the US, in Europe, they have legislation coming out that we had to comply by 2027.

It's called Cyber Resilience Act.

And we had to be ready with all of our systems.

So customers get capabilities beyond previously associated with larger PLC system while retaining the simplicity and cost-effectiveness expected in small applications.

These features help protect against unauthorized access, support compliance requirements, and improve long-term operational reliability.

Okay, we're talking compliance.

The Cyber Resilience Act that we touched on a minute ago is on the tip of everyone's tongue in this space.

And that deadline for compliance is going to be here before we know it.

The thread connecting these first three stories is trust being used as a weapon, and European regulators have clearly had enough of that.

Starting this week, the European Union's Cyber Resilience Act requires companies selling connected products in Europe to report serious security incidents to regulators within 24 hours of discovery.

That's not 72 hours, not a week, 24 hours.

The law covers manufacturers, developers, and distributors of virtually anything with software or network connectivity, from consumer electronics to industrial equipment.

Let's venture over to the corporate land a little bit in Europe, or well, more specifically, in the European Union market, which means that we're also talking to folks in other countries who are not in the European Union, but they might have a product on that market.

Because I don't know if you heard but there is this thing called Cyber Resilience Act which is not about open source but it does affect open source as well it is about all the digital products that are hitting the European market.

And if they happen to have some kind of vulnerability in them, that is a problem.

And if that vulnerability, to my knowledge, if it is in an open source project, like the vulnerability itself is in the upstream project, then the companies also have some responsibilities to report that vulnerability, um, probably multiple places, but one of those is the open source community itself.

And I also remember reading it somewhere that if the company has a fix to the vulnerability, they are also obligated to share that.

Now, the Cyber Resilience Act has been a long process of forming and then having all the standards and processes set up around it and some deadlines are coming up.

So can you give a little bit of an overview of where we are and what crazy things I said that may or may not be reality?

So the European Union Cyber Resilience Act is one of the most impactful pieces of legislation that I've seen in my career.