English
Français
Deutsch
Español
Italiano
📅 Oct. 27-29, 2026
it-sa Expo&Congress
Nuremberg, Germany
🤝 Meet Expertware
OCCTET
Open Source Compliance Toolkit
CRA Readiness for SMEs & OSS Projects
OCCTET (Open-source Compliance: Comprehensive Techniques and Essential Tools) is an EU-funded project that helps small and medium-sized enterprises (SMEs) and open source projects get ready for the Cyber Resilience Act (CRA). It provides free, open source tools and practical guidance to manage the open source components inside digital products.
What OCCTET offers today:
- CRA Self-Assessment Platform: measure your CRA readiness in minutes
- OCCTET toolchain: ORT Server, OCCTET Curator and VulnerableCode turn your source code into SBOM, VEX and audit reports, with a getting started guide
- Best practices: checklists, templates and guidance for SMEs, open source projects and stewards
- Deliverables and webinars: the public results of the project and the recordings
For organisations with limited compliance resources, preparing for the CRA is a major undertaking. OCCTET makes that work more manageable by bringing together tools that help them understand their obligations, identify and address vulnerabilities, and maintain the records needed to support compliance.
Executive Director of the Eclipse Foundation
Read the press release
·
(opens an external site)
All press releases Evaluate Your Cyber Resilience Readiness in Minutes
Strengthen your organization's cyber resilience with our quick, easy, and completely free self-assessment tool. The platform helps you instantly measure your compliance and preparedness in line with the EU Cyber Resilience Act (CRA).
Free self-assessment • Confidential processing • Instant next steps
CRA Best Practices for Your Open Source Components
Practical, risk-based guidance from the OCCTET project to help SMEs integrate open source components in line with the EU Cyber Resilience Act (CRA): secure development lifecycle, the role of open source stewards, proportional due diligence and a step-by-step path for SMEs.
Ready-to-use checklists • Downloadable templates • Interactive decision matrix
Be part of the OCCTET journey!
Test the toolkit on your own projects, share your feedback and learn alongside other SMEs and open source maintainers getting ready for the CRA. Subscribe to the newsletter to hear about new releases and events.
Free to join • Hands-on toolkit testing • News and events
News
Watch the final OCCTET webinar: an open source toolkit for Cyber Resilience Act compliance
The recording of the final OCCTET webinar, Exploring an Open Source toolkit for Cyber Resilience Act compliance, organised with the European DIGITAL SME Alliance on 22 October 2026, is now available.
The CRA applies to every company that places products with digital elements on the EU market, whatever its size, and it goes well beyond policies: secure development, vulnerability handling, SBOMs, documentation and post-market monitoring. Without a dedicated compliance team, SMEs and open source maintainers need practical, low-overhead tools to turn these requirements into day-to-day practice. This session showed how the OCCTET toolkit helps, and how to start using it in your own workflows.
In this recording
- Introduction – James Philpot (European DIGITAL SME Alliance)
- The consortium and OCCTET goals – Sébastien Heurtematte (Eclipse Foundation)
- The CRA self-assessment – Andreea Galbau (Expertware)
- The toolkit – Andreas Kotulla (Bitsea), Sebastian Schuberth and Martin von Willebrand (Double Open)
- The toolkit in action – Bernd Prünster (A-SIT Plus)
- What next for the OCCTET toolkit? – Sébastien Heurtematte (Eclipse Foundation)
- Q&A and closing – James Philpot (European DIGITAL SME Alliance)
Watch the webinar (88 min)
Download the slides (PDF)
To start using the toolkit, follow the getting started guide. All OCCTET recordings are available in the webinar library.
Join the final OCCTET webinar: Exploring an Open Source Toolkit for SMEs to manage CRA compliance
📅 Thursday 22 October 2026 | 10:00 – 11:30 CEST | Online
🎙️ This will be the last webinar of the OCCTET project, organised with the European DIGITAL SME Alliance. Come and see the complete OCCTET toolkit in action, and hear from the organisations that tested it.
The Cyber Resilience Act will soon require manufacturers of products with digital elements, including many SMEs and open source projects, to demonstrate cybersecurity by design, manage vulnerabilities and document compliance. For smaller teams, understanding what this means in practice, and which tools can help, is often the biggest hurdle.
🎯 What you will get
✅ Understand what support is available and why tooling matters for a realistic CRA implementation
✅ See the toolkit in action: self-assessment, SBOM generation, vulnerability detection and related tools
✅ Hear real experiences from organisations that tested the tools: what helped, what was challenging
✅ Learn where to access the tools, how to integrate them into your workflows, and how they will remain available and supported after the project
🗓️ Agenda
10:00 – Introduction · James Philpot (European DIGITAL SME Alliance)
10:05 – The consortium and OCCTET goals · Sébastien Heurtematte (Eclipse Foundation)
10:15 – The CRA self-assessment · Andreea Galbau (Expertware)
10:30 – The toolkit · Andreas Kotulla (Bitsea), Sebastian Schuberth and Martin von Willebrand (Double Open)
11:00 – The toolkit in action · Bernd Prünster (A-SIT Plus)
11:15 – What next for the OCCTET toolkit? · Sébastien Heurtematte (Eclipse Foundation)
11:25 – Q&A and closing · James Philpot (European DIGITAL SME Alliance)
🎬 Missed it? Watch the recording, or the previous OCCTET webinars.
Watch OCCTET at CRA Mondays: two talks on tooling for CRA compliance
🎬 OCCTET took part twice in CRA Mondays, the talk series of the Open Regulatory Compliance (ORC) working group hosted by the Eclipse Foundation. Both recordings are now part of our webinar library.
⚙️ Automating CRA compliance at scale (July 2026)
Sébastien Heurtematte (Eclipse Foundation) and Martin von Willebrand (Double Open) present ORT Server results from OCCTET: top open source projects across ten ecosystems compared with GitHub advisory data, and the analysis of Eclipse Foundation projects, over 3,600 repositories in 350+ organisations.
🧰 OCCTET: tooling for CRA compliance (April 2025)
The first CRA Mondays episode: Sébastien Heurtematte explains what the CRA means for SMEs and open source, how OCCTET supports compliance through self-assessment and tooling, and how to get involved.
Partners
OCCTET represents a major step toward strengthening cybersecurity compliance in Europe, especially for SMEs struggling to navigate CRA requirements. Given our expertise in IoT security and product certification, we see this project as an opportunity to bridge the gap between regulation and real-world implementation. By supporting the development of tools that make compliance more accessible and automated, we contribute to a more secure digital ecosystem while supporting innovation and market growth.
OCCTET allows us to ensure and further develop our service to meet the requirements of the SME sector, as opposed to large organizations. SMEs are by far the largest users of software, whether as such or in devices. Further, we expect to partner with other OCCTET members to offer together holistic CRA compliance services, where Double Open's role is in automated analysis and management, and it complements by services of others.
Get Engaged
Contact
Talk to the team
Questions, partnership ideas or feedback? OCCTET brings together seven partners from across Europe: open source foundations, SME associations and technology companies. We would be glad to hear from you.
Email the team
Follow OCCTET