https://OpenChain-Project.github.io/OpenChain-KWG/en/tags/software-supply-chain/Recent content in Software Supply Chain on OpenChain KWGHugoenMon, 10 Aug 2026 11:20:08 +0900https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/08/09/cisa-sbom-minimum-elements/Sun, 09 Aug 2026 00:00:00 +0000https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/08/09/cisa-sbom-minimum-elements/<div class="alert alert-info" role="alert"> <p>This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.</p> </div> <h2 id="summary">Summary</h2> <p>On July 29, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and 17 other agencies published a revised set of minimum elements for a Software Bill of Materials (SBOM)<a id="a2-ref-1"></a><a href="https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/08/09/cisa-sbom-minimum-elements/#a2">A2</a>. The document states plainly that it replaces, rather than amends, the baseline established in 2021 by the National Telecommunications and Information Administration (NTIA).</p>https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/05/18/eu-cra/Mon, 18 May 2026 00:00:00 +0000https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/05/18/eu-cra/<div class="alert alert-info" role="alert"> <p>This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.</p> </div> <blockquote> <p><strong>Summary</strong></p> <p>The EU Cyber Resilience Act (Cyber Resilience Act, CRA — Regulation (EU) 2024/2847) is the EU&rsquo;s first comprehensive product security regulation, imposing horizontal cybersecurity obligations on every &ldquo;product with digital elements&rdquo; (PDE) placed on the EU market. The regulation entered into force on December 10, 2024, and applies in phases. From September 11, 2026, the Article 14 reporting obligations take effect, requiring manufacturers, importers, and distributors to notify ENISA (the European Union Agency for Cybersecurity) and Member State CSIRTs of actively exploited vulnerabilities and severe incidents within a staged 24-hour, 72-hour, and 14-day window. Companies that have not stood up a reporting workflow by this date face fines of up to €15 million or 2.5% of worldwide annual turnover, and Korean companies that place products on the EU market are subject to the obligation immediately. <a id="a1-ref-1"></a><a href="https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/05/18/eu-cra/#a1">A1</a>, <a id="b1-ref-1"></a><a href="https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/05/18/eu-cra/#b1">B1</a>, <a id="e1-ref-1"></a><a href="https://OpenChain-Project.github.io/OpenChain-KWG/en/blog/2026/05/18/eu-cra/#e1">E1</a></p>