git: 0d8bbdb310 - main - status/2026q3: Add Cyber Resilience Act (CRA) entry

The branch main has been updated by jrm:

URL: https://cgit.FreeBSD.org/doc/commit/?id=0d8bbdb310b9733774e8d18dbf5651b724c0a8e4

commit 0d8bbdb310b9733774e8d18dbf5651b724c0a8e4
Author:     Joseph Mingrone <jrm@FreeBSD.org>
AuthorDate: 2026-10-13 22:04:53 +0000
Commit:     Joseph Mingrone <jrm@FreeBSD.org>
CommitDate: 2026-10-18 23:59:29 +0000

    status/2026q3: Add Cyber Resilience Act (CRA) entry
    
    Text author:    Alice Sowerby <alice@freebsdfoundation.org>
    Reviewed by:    status (salvadore)
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D60734
---
 .../en/status/report-2026-07-2026-09/cra.adoc      | 28 ++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/website/content/en/status/report-2026-07-2026-09/cra.adoc b/website/content/en/status/report-2026-07-2026-09/cra.adoc
new file mode 100644
index 0000000000..3a4b5041f9
--- /dev/null
+++ b/website/content/en/status/report-2026-07-2026-09/cra.adoc
@@ -0,0 +1,28 @@
+=== Cyber Resilience Act (CRA) Readiness Project
+
+Links: +
+link:https://github.com/FreeBSDFoundation/all-projects/tree/main/Cyber%20Resilience%20Act%20Readiness[Cyber Resilience Act Readiness] URL: link:https://github.com/FreeBSDFoundation/all-projects/tree/main/Cyber%20Resilience%20Act%20Readiness[]
+
+The Foundation is running a project through 2026 to actively prepare the FreeBSD Foundation, Project, and community for the EU Cyber Resilience Act.
+There are six main areas of focus: Security and Vulnerability Handling, SBOM Toolchain, Public Documentation, Community Legislative Engagement, Public Project Repository, and Communications.
+
+Over Q3, the project has continued to move from planning into implementation, with particular focus on readiness for the CRA's vulnerability and incident reporting requirements that came into force for manufacturers on September 11, 2026.
+
+The Foundation has created a cyber security policy and CRA reporting protocol to support the Foundation in meeting its obligations as an open source software steward.
+Both have been developed with input from the FreeBSD Core and Security Teams and document how the Foundation will work with the Project and respond if CRA reporting obligations are triggered for the Foundation as a steward.
+Note that the European Commission has clarified that reporting obligations for stewards begin on December 11, 2027.
+These documents will remain internal resources for the time being.
+
+Technical work on the Software Bill of Materials (SBOM) toolchain has continued through development, testing, and review.
+The proposed approach for generating SBOMs for the FreeBSD base system is being refined in response to feedback and still requires further review and supporting changes before integration.
+Work is also progressing across the wider SBOM ecosystem, both through the Foundation and in the community, including planned support for ports, SPDX-compatible license information, and CycloneDX and SPDX SBOM support in pkgconf.
+
+Public CRA guidance is now available on the FreeBSD Foundation website, providing an overview of the legislation alongside dedicated link:https://freebsdfoundation.org/guide-to-the-cra-for-freebsd-business-users/[guidance for FreeBSD business users] and link:https://freebsdfoundation.org/guide-to-the-cra-for-freebsd-community-members/[community members].
+This gives FreeBSD users clearer information about how the CRA may affect them, where their responsibilities may sit, and link:https://freebsdfoundation.org/eu-cyber-resilience-act-cra/[how to work with FreeBSD in meeting their CRA obligations].
+
+The Foundation has continued to engage with the FreeBSD and wider open source communities, especially the Eclipse Foundation's Open Regulatory Compliance (ORC) working group.
+At EuroBSDCon 2026, we collaborated with Peter Hansteen to run a day-long link:https://events.eurobsdcon.org/2026/talk/RER8UZ/[CRA and SBOM tutorial].
+We also presented an update on this project at the link:https://wiki.freebsd.org/DevSummit/202609[FreeBSD Developer Summit].
+
+Project updates and meeting notes continue to be published through the public link:https://github.com/FreeBSDFoundation/all-projects/tree/main/Cyber%20Resilience%20Act%20Readiness[project repository].
+As we move into Q4, the focus will be on progressing the SBOM implementation and upstream work, improving the discoverability of our public CRA guidance, and working with the FreeBSD Project to identify key manufacturer needs that relate to their CRA obligation to adopt a secure software lifecycle by December 11, 2027.