OCCTET releases free Toolkit to help SMEs prepare for the EU Cyber Resilience Act

• OCCTET Toolkit launched to help SMEs manage the security of their open source components.

• The Cyber Resilience Act (CRA) mandates cybersecurity controls for all products with digital elements as of 11 December 2027.

• OCCTET’s self-assessment platforn can help SMEs understand their readiness for the CRA.

The European DIGITAL SME Alliance, Europe’s leading organisation representing ICT SMEs, today announced the availability of a free, open-source toolkit developed through the EU-funded OCCTET project to help small and medium-sized enterprises (SMEs) and open-source projects prepare for the European Union’s Cyber Resilience Act (CRA).

The toolkit translates complex regulatory requirements into practical steps that organisations can incorporate into their software development and security processes. It helps them assess their readiness, identify which open-source components are used in their products, manage vulnerabilities, and document how security risks are being addressed.

At a recent webinar, the OCCTET consortium introduced the toolkit in an online session for SMEs, open-source projects, product teams, and other organisations looking for practical, low-overhead ways to prepare for the CRA. The webinar showcased the different components of the toolkit, highlighted how companies could use it and heard from a company about how they would be using the toolkit moving forward.

The toolkit release comes as the CRA’s first obligations take effect. From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements made available in the European Union. The CRA’s broader requirements will apply from 11 December 2027.

Early use of the OCCTET self-assessment platform has identified a common challenge: many SMEs have security measures in place but lack the visibility, documentation, and consistent processes needed to demonstrate how software risks are being managed.

“OCCTET gives SMEs practical guidance and open-source tools, available free of charge and designed to be easy to use, to help them prepare for the CRA and manage software vulnerabilities” said Sebastien Heurtematte, the project coordinator. “As CRA deadlines approach and critical vulnerabilities emerge at a rapid pace, the ability to identify risks and respond quickly is vital. Sustaining these tools through active communities and continued collaboration between SMEs, developers and open-source communities will be essential to build on these results and make software security more accessible.”

A practical path from assessment to action

The OCCTET toolkit combines multiple services that support organisations from initial assessment through vulnerability management and documentation.

SMEs and open-source projects can now access and test the following services:

• Assess readiness: The CRA Self-Assessment Portal helps SMEs understand how the CRA applies  to them, evaluate their current readiness, and identify areas requiring attention. The free, guided assessment translates CRA provisions into structured questions, scoring, and practical recommendations.
• Identify software components: Eclipse Apoapsis (OCCTET instance) identifies open-source components, dependencies, and licenses, based on the OSS Review Toolkit and known vulnerabilities. It can also generate a range of CRA-ready reports and compliance artefacts, including Software Bills of Materials (SBOMs), which provide a standardised inventory of the software components contained in a product.
• Review findings and take action: Bitsea Curator (OCCTET instance) combines automated analysis with human review to help users verify software information, assess whether vulnerabilities affect their products, prioritise issues, and document their decisions. It also supports the creation of Vulnerability Exploitability eXchange (VEX) reports, which record whether a product is affected by a known vulnerability.
• Reuse shared software information: The Federated OSS Assessment Database, io, provides information about open-source packages, including their origins, licenses, security advisories, vulnerabilities, and reference SBOMs. Its public PurlDB demonstrator supports reference SBOM generation for more than 20 million packages, while its VulnerableCode integration connects vulnerability information with the software packages it affects.

The toolkit has been validated against complex, real-world software dependency scenarios across ten different technology ecosystems. Testing has included widely used open-source projects, large-scale analysis of the Eclipse Foundation’s entire project portfolio, as well as a growing number of real-world SME use cases. This extensive validation demonstrates the toolkit’s ability to operate across diverse technologies, project sizes, and software supply chains.

This testing has demonstrated its ability to analyse complex dependency structures, identify vulnerabilities, support human review, and monitor security issues over time.

Get started with OCCTET

The Open-Source Compliance: Comprehensive Techniques and Essential Tools (OCCTET) project brings together industry leaders, cybersecurity experts, SME representatives, and open-source organisations to make software security and CRA preparation more accessible, transparent, and cost-effective.

SMEs and open-source projects can explore the toolkit and available resources at occtet.eu. Organisations interested in testing the services using real products and development workflows, and providing feedback to support their continued improvement, can visit the OCCTET Get Engaged page.

OCCTET complements the project partners work to help organisations and open-source communities prepare for the CRA. Through the Open Regulatory Compliance (ORC) Working Group, participants are developing community-driven specifications, guidance, training, and other resources to support CRA implementation across the open-source ecosystem.

These resources include the free ORC Learning Hub, which provides practical, role-specific training to help open-source developers, maintainers, project stewards, product teams, and security and compliance professionals understand how the CRA applies to their work and put its requirements into practice.

About the OCCTET Project

Open Source Compliance: Comprehensive Techniques and Essential Tools (OCCTET) is an EU-funded initiative focused on helping SMEs and open source projects navigate cybersecurity and compliance requirements under the Cyber Resilience Act. Coordinated by the Eclipse Foundation, the project is developing an integrated suite of free, open source tools for readiness assessment, software dependency analysis, vulnerability management, SBOM generation, and compliance documentation.

The OCCTET project has received funding from the Digital Europe Programme under grant agreement No. 101190474. The content does not necessarily reflect the views of the European Commission. The European Commission is not liable for any use that may be made of the information contained herein.

Learn more at occtet.eu.