Beyond NIS2: Software Supply Chains and the Cyber Resilience Act (CRA)#

Barry O'Donovan, INEX

• Why: NIS2 governs how you run your network; the CRA governs the software you run it with — including the open-source stacks most operators depend on. With mandatory vulnerability reporting live since September 2026, this is now procurement-reality, not policy theory.
• What: A bridge from NIS2 operator obligations to CRA software requirements: the critical distinction between Commercial OSS Manufacturers (full product liability, CE marking, fines) and Open-Source Software Stewards (non-profit foundations under a light-touch regime, duties from 11 December 2027), with ecosystem examples — INEX and NLnet Labs as stewards vs. enterprise Linux vendors as manufacturers. Also covers what operators can legally expect from upstream maintainers on SBOMs, vulnerability disclosure and patch timelines, and reporting duties (24-hour early warning, 72-hour notification).
• How: Walkthrough of the Commission's scope examples and the "intended for commercial activities" test, plus a roadmap for auditing open-source dependencies and consuming standardized security feeds.
• Where applicable: EU-market entities, but the checklist is useful for any operator publishing community tools or procuring network software.