BRUSSELS and WILMINGTON, Del., July 30, 2026 (GLOBE NEWSWIRE) -- The Eclipse Foundation, one of the world’s largest open source software foundations, and the Open Worldwide Application Security Project (OWASP), a global nonprofit foundation dedicated to improving software security, today announced a Memorandum of Understanding (MoU) to strengthen open source security and support industry readiness for the European Union’s Cyber Resilience Act (CRA).
The agreement combines the Eclipse Foundation’s expertise in open source governance, industry collaboration, and regulatory readiness with OWASP’s globally recognised security projects, standards, education, and community. The organisations will develop resources to help open source maintainers, stewards, manufacturers, and software teams strengthen security practices and respond to evolving regulatory requirements.
“Open source is critical digital infrastructure, but responsibility for securing it is distributed across a complex global ecosystem,” said Mike Milinkovich, executive director of the Eclipse Foundation. “With AI accelerating both software development and vulnerability discovery, and the first CRA obligations taking effect in a matter of weeks, the need for practical, coordinated action is increasingly urgent. By bringing together the expertise and communities of the Eclipse Foundation and OWASP, we can reduce fragmentation and help organisations put stronger security and regulatory readiness practices into action.”
The CRA introduces mandatory cybersecurity requirements for products with digital elements made available in the EU, including products built with or dependent on open source software. Its vulnerability and incident reporting obligations for manufacturers take effect on 11 September 2026, requiring organisations to establish the processes and technical capabilities needed to identify, manage, and report serious security issues.
The regulation also formally recognises open source software stewards as important participants in the software supply chain. Although their responsibilities differ from those of commercial manufacturers, stewards will play an important role in supporting secure development, vulnerability management, transparency, and cooperation across the open source ecosystem.
“Security guidance only makes a difference when developers, maintainers, and organisations can put it into practice,” said Andrew van der Stock, executive director of the OWASP Foundation. “By working with the Eclipse Foundation, we can extend the reach and impact of OWASP’s security expertise while giving open source communities clearer, more actionable ways to strengthen the software supply chain and prepare for the CRA.”
Although the CRA is a European regulation, its implications extend globally. Any organisation that makes software-enabled products available in the EU must understand its responsibilities, including how it develops, integrates, documents, maintains, and secures the open source components on which those products depend. With more than 96% of commercial codebases containing open source software, according to the OpenLogic 2026 State of Open Source Report, CRA readiness is an urgent consideration across the global software industry.
Under the MoU, the Eclipse Foundation and OWASP intend to collaborate across five principal areas:
- CRA readiness for the open source ecosystem
- Alignment and interoperability among security practices and frameworks
- Joint education and community engagement
- Open source stewardship and maintainer support
- Policy and regulatory education
Initial priorities are expected to include practical guidance for open source stewards, joint CRA readiness webinars, resources supporting software bill of materials (SBOM) adoption and software supply chain security, and community events, workshops, and maintainer roundtables.
The two organisations also participate jointly in the Eclipse Foundation’s Open Regulatory Compliance Working Group (ORC WG), which brings together open source foundations, global enterprises, and industry stakeholders to develop practical resources for navigating the growing impact of software regulation on open source.
The organisations do not intend to create competing security frameworks. Instead, they will work to align and amplify existing initiatives, improve adoption, and help organisations embed sustainable security and regulatory readiness practices across the software lifecycle.
For more information about the Eclipse Foundation’s work on open source regulatory compliance, visit orcwg.org. To learn more about OWASP’s community-led software security projects, standards, and educational resources, visit owasp.org.
About OWASP
The OWASP Foundation is a nonprofit organisation that works to improve software security. Through community-led open source software projects, over 260 local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web. For nearly two decades, corporations, foundations, developers, and volunteers have supported the OWASP Foundation and its work. To learn more or to become a member, visit owasp.org.
About the Eclipse Foundation
The Eclipse Foundation provides a global community of individuals and organisations with a vendor-neutral, business-friendly environment for open source collaboration and innovation. We host Adoptium, the Eclipse IDE, Jakarta EE, Open VSX, Software Defined Vehicle, and more than 450 high-impact open source projects. Headquartered in Brussels, Belgium, we are an international non-profit association supported by over 300 members. Our events, including Open Community Experience (OCX), bring together developers, industry leaders, and researchers from around the world. To learn more, follow us on X and LinkedIn, or visit eclipse.org.
Media contacts:
Schwartz Public Relations
Julia Rauch/Luca Myska
Sendlinger Straße 42A
80331 München
EclipseFoundation@schwartzpr.de
+49 (89) 211 871 -43/ -52
514 Media Ltd (France, Italy, Spain)
Benoit Simoneau
benoit@514-media.com
M: +44 (0) 7891 920 370
Nichols Communications (Global Press Contact)
Jay Nichols
jay@nicholscomm.com
+1 408-772-1551
