Pioneering Cyber Resilience: How SUSE Helps Shape the Future of Open Source Security

Pioneering Cyber Resilience: How SUSE Helps Shape the Future of Open Source Security The European Union’s Cyber Resilience Act (CRA) is not just another regulatory compliance hurdle; it represents a fundamental shift in how the software industry approaches security. For years, the tech community has discussed “secure-by-design” and customer protection as an ideal. The CRA is now codifying that ideal into law. Key takeaways - Pioneering Reporting Standards: SUSE is collaborating to pilot the EU’s Single Reporting Platform (SRP) ahead of the September 2026 deadline. - Leading Compliance: SUSE is actively sharing open source security expertise to help ensure upcoming compliance frameworks are practical for modern software development. - Digital Sovereignty & Security: Our strategy balances commercial responsibility for enterprise-grade solutions with deep stewardship for upstream open source innovation.º At SUSE, we don’t view the CRA as a reactive, box-ticking exercise. We see it as a catalyst for innovation. As an open source leader, we are taking a proactive role — not just preparing our own portfolio, but actively collaborating with European regulators to ensure the final standards are practical, effective, and sustainable for the entire software ecosystem. Here is an inside look at our progress, our collaboration with regulators, and our roadmap to compliance. Gaining an inside track: The Single Reporting Platform (SRP) One of the first major milestones of the CRA is the introduction of strict vulnerability reporting obligations, coming into effect in September 2026. To facilitate this, the European Union Agency for Cybersecurity (ENISA) is developing the Single Reporting Platform (SRP). SUSE is proud to participate in the early testing phase of this platform, happening this July. Why this matters: Participating in this pilot gives us early visibility into reporting expectations. It allows our security teams to stress-test our internal processes directly against ENISA’s platform before the deadlines arrive. By working through the technical and procedural details now, we minimize transition risks and help shape a reporting mechanism that actually works in the real world. Shaping the standards, not just following them Full CRA compliance is mandated by December 2027, but the specific compliance checklists are being written today. We believe that modern, iterative software development needs a voice in those regulatory rooms. While SUSE’s products fall into specific product categories defined by the CRA, we are actively engaging with regulatory bodies and participating in industry discussions to share our expertise and ensure that new standards are practical and effective for the modern software ecosystem. Our teams successfully collaborated on several proposals for these checklists. By sharing our experience and close alignment with robust security frameworks already in place — and publicly recognized by regulated industries and authorities in products like SUSE Linux Enterprise Server — we are proving that compliance and agile development can go hand-in-hand. Stewardship & digital sovereignty: Protecting open source innovation A critical aspect of the CRA conversation is the role of open source and digital sovereignty: the ultimate right of organizations, enterprises, and governments to maintain complete ownership and control over their digital destiny as a foundation for long-term business resilience. At SUSE, we believe that true digital sovereignty is built on a foundation of open source software. Our philosophy remains clear: we balance our responsibilities as a commercial manufacturer with our duties as a champion of open source freedom. - As a manufacturer: We take full legal and security responsibility for the commercial, enterprise-grade products we place on the market, giving our customers the secure, compliant foundation they need to maintain control over their infrastructure. - As a steward: We remain deeply committed to protecting the community-driven upstream projects that form the backbone of our industry. For digital sovereignty to succeed, regulation must hold commercial actors accountable without stifling the open collaboration that drives global innovation. Transparent progress: Our roadmap to 2027 We believe in being upfront about our progress. We aren’t claiming early victory or immediate 100% compliance today — the regulatory landscape is still evolving. However, our technical teams are moving at an accelerated pace: - Reporting Infrastructure: Our CRA Product Security Incident Response Team (PSIRT) operating model is fully established. - Current Status: We have made significant progress in our CRA roadmap. Currently, most of our core products, including our widely used SUSE Linux and SUSE Cloud Native solutions, are already aligned with the framework for the upcoming September 2026 reporting requirements. - Active Engineering: Technical teams are focused on aligning our remaining product portfolios with these same high standards, ensuring consistent protection across our entire ecosystem. - Incident Response: We have consolidated our PSIRT framework and are drafting a company-wide Coordinated Vulnerability Disclosure (CVD) policy to ensure seamless coordination. Building a secure digital future The journey toward full CRA compliance is a marathon, not a sprint. As regulatory guidance continues to evolve, SUSE will remain at the forefront — adapting our tech, advocating for reasonable standards, and keeping our products secure. We invite our customers, partners, and the broader open source community to join us in this dialogue. Together, we aren’t just building software; we are building a more resilient digital future. Related Articles Jan 13th, 2026 Grafana Alloy – Part 2 – Replacing Prometheus Node Exporter May 16th, 2025