3 ms·

In case anyone is interested: The EU did publish the draft "standardization request" recently https://ec.europa.eu/docsroom/documents/58974 https://ec.europa.eu

In case anyone is interested: The EU did publish the draft "standardization request" recently https://ec.europa.eu/docsroom/documents/58974 https://ec.europa.eu/docsroom/documents/58974 This is the request which will allow the three european standardization organizations (CEN, CENELEC, ETSI) to draft the required 41 standards for the Cyber Resilience Act (CRA). See page 17 and following for the list. To participate in the standardization you have to be part of a "national body" and they will "send" you to participate in EU standardization. I know no one from my FOSS circles who has any experience there, as most relevant standards for us are written outside of these organizations (W3C, IETF etc.) So we're currently trying to get an official seat at the table via the established ways (e.g. DIN in Germany, https://standards.cencenelec.eu/dyn/www/f?p=CEN:5 https://standards.cencenelec.eu/dyn/www/f?p=CEN:5 see this for your own country). If you are interested in this please send me an email, we're trying to put together a guide on how to engage in "official" standardization efforts as Open Source people. The effort from this blog post is (amongst other things) trying to establish a whole new way of engaging with the EU. We need both approaches.

dvdkon 2y ago
I'd like to give my comments on the new standards, but I'm never going to be chosen to be part of an elite squad of standards-writers. Is there any chance of the standards developing more in the open, with a community in addition to the committee?
- lars_francke 2y ago
  It is not so much an elite squad as more a bunch of people willing to spend the entrance fee and to commit their time. The exact requirements depend on the country you're in though. So if that is your only concern but you are willing to spend time feel free to reach out. About your actual question: The answer is "not really" no. ETSI has a way to adopt existing standards: https://www.etsi.org/images/files/ETSI_PAS_Process_Guide.pdf https://www.etsi.org/images/files/ETSI_PAS_Process_Guide.pdf But CEN and CENELEC (which are probably relevant here) do not. The effort from the blog post is partially about a long term plan to get the EU to change this. But in the short term it'll be hard to change the rules in time for the CRA standards.

dvdkon 2y ago

I'd like to give my comments on the new standards, but I'm never going to be chosen to be part of an elite squad of standards-writers. Is there any chance of the standards developing more in the open, with a community in addition to the committee?

lars_francke 2y ago
It is not so much an elite squad as more a bunch of people willing to spend the entrance fee and to commit their time. The exact requirements depend on the country you're in though. So if that is your only concern but you are willing to spend time feel free to reach out. About your actual question: The answer is "not really" no. ETSI has a way to adopt existing standards: https://www.etsi.org/images/files/ETSI_PAS_Process_Guide.pdf https://www.etsi.org/images/files/ETSI_PAS_Process_Guide.pdf But CEN and CENELEC (which are probably relevant here) do not. The effort from the blog post is partially about a long term plan to get the EU to change this. But in the short term it'll be hard to change the rules in time for the CRA standards.