In brief

• Expertware, a Romanian cybersecurity and IT company developing solutions that help organisations strengthen their security and digital resilience, highlights the availability of a free, open-source toolkit developed through the EU-funded OCCTET project to support Cyber Resilience Act (CRA) readiness.

• The toolkit covers four stages: self-assessment, inventorying open-source components, reviewing and documenting vulnerabilities, and reusing previously published software information.

• The CRA's first obligations apply from 11 September 2026, with its broader requirements taking effect on 11 December 2027.

During the OCCTET project's final webinar, held on 22 October 2026, Expertware and its consortium partners presented a free, open-source toolkit developed to help small and medium-sized enterprises (SMEs) and open-source projects prepare for the European Union’s Cyber Resilience Act (CRA).

The toolkit translates complex regulatory requirements into practical steps that organisations can incorporate into their software development and security processes. It helps them assess their readiness, identify which open-source components are used in their products, manage vulnerabilities, and document how security risks are being addressed.

The consortium introduced the toolkit at a recent webinar for SMEs, open-source projects, product teams, and other organisations looking for practical, low-overhead ways to prepare for the CRA. The session showcased the different components of the toolkit, highlighted how companies could use it, and heard from a company about how they would be using the toolkit moving forward.

What early assessments revealed

Early use of the OCCTET self-assessment platform has identified a common challenge: many SMEs have security measures in place but lack the visibility, documentation, and consistent processes needed to demonstrate how software risks are being managed.

“OCCTET gives SMEs practical guidance and open-source tools, available free of charge and designed to be easy to use, to help them prepare for the CRA and manage software vulnerabilities. As CRA deadlines approach and critical vulnerabilities emerge at a rapid pace, the ability to identify risks and respond quickly is vital.”

-Sebastien Heurtematte, OCCTET project coordinator

“Sustaining these tools through active communities and continued collaboration between SMEs, developers and open-source communities will be essential to build on these results and make software security more accessible,” Heurtematte added.

A practical path from assessment to action

The OCCTET toolkit combines multiple services that support organisations from initial assessment through vulnerability management and documentation.

SMEs and open-source projects can now access and test the following services.

1. Assess readiness

The CRA Self-Assessment Portal helps SMEs understand how the CRA applies to them, evaluate their current readiness, and identify areas requiring attention. The free, guided assessment translates CRA provisions into structured questions, scoring, and practical recommendations.

2. Identify software components

Eclipse Apoapsis (OCCTET instance) identifies open-source components, dependencies, and licenses, based on the OSS Review Toolkit and known vulnerabilities. It can also generate a range of CRA-ready reports and compliance artefacts, including Software Bills of Materials (SBOMs), which provide a standardised inventory of the software components contained in a product.

3. Review findings and take action

Bitsea Curator (OCCTET instance) combines automated analysis with human review to help users verify software information, assess whether vulnerabilities affect their products, prioritise issues, and document their decisions. It also supports the creation of Vulnerability Exploitability eXchange (VEX) reports, which record whether a product is affected by a known vulnerability.

4. Reuse shared software information

VulnerableCode, a federated and open vulnerability database, provides critical information about open-source packages, including their origins, licenses, security advisories, vulnerabilities, and reference SBOMs. VulnerableCode connects vulnerability information with the software packages it affects, while the public PurlDB demonstrator supports reference SBOM generation for more than 20 million packages.

How it was tested

The toolkit has been validated against complex, real-world software dependency scenarios across ten different technology ecosystems. Testing has included widely used open-source projects, large-scale analysis of the Eclipse Foundation's entire project portfolio, as well as a growing number of real-world SME use cases. This extensive validation demonstrates the toolkit's ability to operate across diverse technologies, project sizes, and software supply chains.

This testing has demonstrated its ability to analyse complex dependency structures, identify vulnerabilities, support human review, and monitor security issues over time.

Get started with OCCTET

The Open-Source Compliance: Comprehensive Techniques and Essential Tools (OCCTET) project brings together industry leaders, cybersecurity experts, SME representatives, and open-source organisations to make software security and CRA preparation more accessible, transparent, and cost-effective.

• The toolkit and its resources - available at occtet.eu

• Testing on real products - organisations interested in using the services with real products and development workflows, and providing feedback to support their continued improvement, can visit the OCCTET page

OCCTET complements the project partners' work to help organisations and open-source communities prepare for the CRA. Through the Open Regulatory Compliance (ORC) Working Group, participants are developing community-driven specifications, guidance, training, and other resources to support CRA implementation across the open-source ecosystem.

These resources include the free ORC Learning Hub, which provides practical, role-specific training to help open-source developers, maintainers, project stewards, product teams, and security and compliance professionals understand how the CRA applies to their work and put its requirements into practice.

About the OCCTET Project

Open Source Compliance: Comprehensive Techniques and Essential Tools (OCCTET) is an EU-funded initiative focused on helping SMEs and open source projects navigate cybersecurity and compliance requirements under the Cyber Resilience Act. Coordinated by the Eclipse Foundation, the project is developing an integrated suite of free, open source tools for readiness assessment, software dependency analysis, vulnerability management, SBOM generation, and compliance documentation.

Learn more at occtet.eu

The OCCTET project has received funding from the Digital Europe Programme under grant agreement No. 101190474. The content does not necessarily reflect the views of the European Commission. The European Commission is not liable for any use that may be made of the information contained herein.

About Expertware

Expertware is a Romanian IT and cybersecurity company founded in 2006, with extensive experience in developing technology solutions and delivering cybersecurity services across Europe. Its expertise spans Security Operations Centres (SOCs), managed cybersecurity services, cloud and hybrid infrastructures, cybersecurity platforms and complex enterprise IT environments.

Expertware is the company behind SIEMBIOT, an integrated cybersecurity platform that brings together security monitoring, threat intelligence, vulnerability management and incident response capabilities. Through SIEMBIOT and its cybersecurity consulting services, Expertware helps organisations strengthen their security posture, manage cyber risks and address regulatory requirements through its dedicated compliance module including the NIS2 Directive and the Cyber Resilience Act (CRA).

Through its involvement in European research and innovation initiatives such as OCCTET, Expertware also contributes to developing practical tools that help organisations assess their cybersecurity maturity and prepare for evolving regulatory requirements.

Learn more at expertware.net