Project deliverables

It establishes the rules and procedures for the 24-month, EU-funded OCCTET project, which aims to develop open-source tools to simplify Cyber Resilience Act (CRA) compliance for SMEs using FOSS.

The project is coordinated by the Eclipse Foundation (ECL) and governed by an organizational structure including the Executive Board. The Handbook defines essential management tools (GitLab for tracking, Matrix for communication) and details protocols for:

• Project Management: Using GitLab for issue tracking and progress monitoring.
• Meetings Management: Defining the purpose, frequency, and documentation of all project meetings.
• Risk Management: Establishing a proactive process for identifying and mitigating technical, compliance, and operational risks.
• Reporting: Outlining requirements for internal quarterly reports and official periodic reports to the EU Commission.
• Deliverables Management: Defining a rigorous review and submission process for quality assurance.
• Legal and Ethical Ground Rules: Ensuring compliance with the Grant Agreement, GDPR, and research integrity standards.

The plan utilizes the RE-AIM framework (Reach, Effectiveness, Adoption, Implementation, Maintenance) to ensure a holistic evaluation of both internal execution and real-world impact. Key objectives and their corresponding performance indicators (KPIs) are defined across these five dimensions:

• Reach: Engage at least 100 SMEs and achieve 5,000 unique web users.
• Effectiveness: Achieve 100% coverage of pre-market CRA requirements and reduce self-assessment time by over 25%.
• Adoption: Integrate solutions into the operational workflows of 100+ SMEs.
• Implementation: Ensure timely, high-quality delivery of 10-15 project tools (95%+ adherence to timeline).
• Maintenance: Ensure long-term sustainability with 250+ regular tool users 12 months post-project.

The framework is built on four core pillars: maintaining high Ethical standards, using open source licenses for project outputs (IPR), ensuring secure and GDPR-compliant data handling (Data), and implementing privacy-by-design (Privacy). The project engages participating SMEs in three stages to gather baseline, ongoing, and concluding data, focused on CRA compliance metrics.

The objective of this document is to consolidate regulatory obligations stemming from the Cyber Resilience Act (CRA) and translate them into structured compliance requirements tailored to Small and Medium-sized Enterprises (SMEs) and the Free and Open Source Software (FOSS) ecosystem.

The framework is grounded in a structured methodological approach combining regulatory analysis, stakeholder engagement, survey results from SMEs and FOSS contributors, desk research, and expert consultation within the consortium. The survey instruments were aligned with the structure of the CRA, enabling direct mapping between stakeholder realities and regulatory domains, including essential cybersecurity requirements, role-based responsibilities, vulnerability handling, lifecycle management, and conformity assessment pathways.

The objective of this deliverable is to provide a structured, legally grounded and operationally practical framework enabling small and medium-sized enterprises (SMEs) to assess their level of alignment with the requirements of the Cyber Resilience Act (CRA).

The model translates CRA Articles and Annexes obligations into structured assessment questions, supported by scoring logic, explanatory guidance and evidence indicators. The methodology ensures traceability between legal provisions and questionnaire items. The deliverable describes:

• The legal mapping methodology linking CRA provisions to assessment criteria
• The scoring model and maturity structure
• The Oxy AI support mechanism used to assist interpretation
• Validation activities conducted with consortium partners and SMEs
• Tool testing evidence (further detailed in Annex 2)

The model contributes to OCCTET’s objective of strengthening SME capacity for CRA compliance by providing a free, structured and open methodology aligned with EU legislative requirements.

It emphasizes the risk-based approach of the CRA, where risk is contextual to the FOSS component’s criticality and usage. The guide promotes a proportional, risk-based philosophy for FOSS developers, focusing on:

• Integrating security across the lifecycle.
• Ensuring governance and transparency (e.g., security contacts).
• Building supply chain resilience (secure release practices).

The document also clarifies the roles of Open Source Stewards regarding CRA Article 25 attestations and provides specific SME CRA compliance guidelines, including advice on due diligence for consuming FOSS and security attestations.

FedDB-Beta-Del is the first demonstrator release for a reference federated software metadata platform under the OCCTET project. It establishes the basis for an open, resilient, and collaborative base system for sharing essential free and open source software (FOSS) metadata (origin, licenses, vulnerabilities) and enables more efficient Cyber Resilience Act (CRA) compliance processes for SMEs.

To overcome the bottlenecks of centralized systems, OCCTET is implementing a decentralized approach building on proven AboutCode open source technologies and designs. This initial demonstrator focuses on providing decentralized access to curated, open-source vulnerability data with key features including

• Decentralized Data Access
• PURL-Based Discovery with AboutCode Hashid

This demonstrator validates that the core data components are available and can be used, either through direct access keyed by PURL, in bulk or through the public APIs. PURL adoption further validates our approach as the base for the next deliverables in a world where FOSS software packages (and PURL) are the key software supply chain entities.

This initiative addresses the critical need for compliance tools among Small and Medium-sized Enterprises (SMEs) following the EU’s Cyber Resilience Act (CRA), which mandates “security by design,” vulnerability management, and documentation (like SBOM and VEX).

The OCCTET project delivers a holistic, integrated, open-source solution comprising:

• ORT Toolchain (ort-server): Provides automated dependency analysis, license scanning, vulnerability identification, policy evaluation, and generation of standard SBOMs (SPDX, CycloneDX), accessible via a central server and GUI.
• Occtet-Curator: An AI-supported web application for human-in-the-loop audit workflows, inventory management, and planned VEX generation to streamline compliance.
• Federated Database (VulnerableCode, etc.): Delivers essential, aggregated security vulnerability and reference data to enrich the SBOMs.

The deliverable focuses on demonstrating how the OCCTET toolchain can support practical software supply chain analysis, vulnerability management, SBOM generation, and compliance evidence preparation. It brings together several complementary components:

• ORT Server: Provides automated Software Composition Analysis (SCA), including dependency discovery, license scanning, vulnerability identification, policy evaluation, and continuous monitoring through scheduled workflows.
• OCCTET Curator: Provides an AI-supported, human-in-the-loop curation workflow to review scan results, improve metadata quality, support false-positive analysis, and generate CRA-oriented evidence.
• SBOM and VEX workflows: Supports the generation of software inventories and compliance artefacts, including SPDX and CycloneDX SBOMs and VEX-oriented vulnerability evidence.
• Validation on OSS and SME use cases: Demonstrates the toolkit on widely used open-source projects and concrete SME validation cases, including infrastructure projects such as Apache Kafka, Hadoop, Tomcat and Jetty.

The toolkit demonstrator confirms the ability of the OCCTET toolchain to analyse complex dependency structures, detect and prioritise vulnerabilities, support vulnerability curation, and continuously monitor evolving security issues over time.

The platform is designed around Package URL (PURL) as the common identifier for software supply chain data. This enables software metadata to be discovered, shared, reused, and federated across tools and ecosystems.

The final demonstrator includes several major improvements:

• Federated package metadata: PurlDB mines and publishes package origin and license metadata into FederatedCode repositories.
• Reference SBOM generation: PurlDB can generate CycloneDX SBOMs for tracked packages through a dedicated API action.
• Large-scale package coverage: SBOM generation is available for more than 20 million packages held in the public PurlDB demonstrator.
• Advisory-centric security data: VulnerableCode has been refactored from a vulnerability-centric model to a package-advisory model, making the data more actionable for automated vulnerability management.
• Decentralized data publication: Demonstrator data is published through API-accessible services and more than 200 Git repositories keyed by PURL.
• Improved adopter guidance: The updated AboutCode resources help SMEs and software teams navigate open data, open standards, and open-source tooling for CRA-related software supply chain management.

By allowing SMEs and software teams to reuse trusted origin, license, vulnerability, and SBOM metadata instead of recomputing it independently, D3.4 directly supports the OCCTET objective of reducing the CRA compliance burden through open, federated, and reusable software supply chain data.

The core objective is to raise awareness and drive the adoption of the toolkit, targeting at least 1,000 active users within the 24-month project duration. The strategy is executed in three phases:

1. Pre-launch (M1–M8): Branding, anticipation building, and needs analysis workshops.
2. Post-Launch (M9–M20): Active promotion through webinars, training, social media, and industry events.
3. Sustainability (M20–M24): Ensuring long-term use and maintenance via knowledge transfer.

Key audiences include SMEs, Open-Source Developers, Regulatory Authorities, and European Digital Innovation Hubs (EDIHs). Communication leverages a multi-channel approach (website, LinkedIn, GitHub, events) tailored with key messages on “Simplifying CRA compliance” and “Open Source Security.”