Dear all,

Thank you very much for giving us the opportunity to host a Devroom at FOSDEM again this year.

We are truly grateful for your support and delighted to be part of FOSDEM once more.

We're looking forward to building on last year's success and making this year's Devroom an even more valuable experience for the community.

Please find our CfP below:

Last edition, the CRA in Practice DevRoom at FOSDEM 2026 brought together developers, maintainers, stewards, manufacturers, security practitioners, policymakers, and standards contributors to move the conversation around the CRA from awareness to practical implementation. 

This year, we want to build on that success with a DevRoom looking at cybersecurity policy and regulation from an open source perspective. While the CRA remains an important focus, we welcome contributions on the wider cybersecurity policy landscape, including NIS2, DORA, cybersecurity aspects of AI policy, the Cyber Security Act, technology sovereignty and cybersecurity, and comparable cybersecurity initiatives from outside Europe. We particularly welcome practical perspectives from the US, Japan, South Korea, and other regions.

The common theme is putting cybersecurity policy into practice. How can developers, maintainers, foundations, manufacturers, and security practitioners turn regulatory requirements and policy objectives into practical, sustainable approaches to building and maintaining secure software?

We invite proposals for talks, panels, and workshops that share practical experience, case studies, tools, standards, lessons learned, or new approaches.

We welcome proposals covering, but not limited to:

• CRA in practice: implementation, vulnerability handling, reporting, conformity assessment, and lessons learned
• Open source readiness: how projects, maintainers, stewards, and manufacturers can address emerging requirements
• Cybersecurity and AI: the EU AI Act, Action Plan on Cybersecurity and Artificial Intelligence, AI security, and AI-assisted security
• Cybersecurity aspects of the EU Tech Sovereignty Package and European Open Source Strategy: practical implications for software security, resilience, strategic dependencies, trusted infrastructure, and open source ecosystems
• Global perspectives: cybersecurity policy and implementation in the US, UK, Japan, South Korea, and other regions
• NIS2, DORA, CSA and other cybersecurity frameworks: practical implications for open source and software ecosystems
• Policy interoperability: aligning requirements across different jurisdictions and frameworks
• Tooling and engineering practices: open tools, automation, security processes, documentation, and workflows that help make cybersecurity requirements measurable and achievable 
• Community and ecosystem approaches: how foundations, stewards, manufacturers, researchers, and governments can collaborate
• Real-world case studies: experiences implementing cybersecurity requirements across projects, organizations, and sectors

We are particularly interested in contributions that go beyond explaining policy and demonstrate what works in practice. If your session helps the open source community understand, implement, or challenge emerging cybersecurity requirements through concrete experience and open collaboration, we would love to hear from you.

Session Types and Lengths - please indicate your preferred format:

• Lightning talks (10 minutes) – quick insights, new ideas, or focused demos
• Standard talks (20 minutes) – technical deep dives, case studies, or practical experiences
• Panels (30 minutes) – cross-role or cross-region discussions around a key challenge

Important dates:

• 27 October - Call for proposals opened (please note that speakers must be available to present their sessions in person) 
• 26 November - Submission deadline
• 5 December (or earlier) - Selected speakers notified
• 7 December - Schedule published
• This devroom will take place on Saturday, 30 January 2027, in the morning

We would love to hear from you! Submit your proposal here https://pretalx.fosdem.org/fosdem-2027/cfp and make sure to select the “Beyond the CRA - Building Secure and Resilient Open Source” track.

All participants must follow the FOSDEM Code of Conduct https://fosdem.org/2027/practical/conduct/

If you have any questions or need any further information, please don't hesitate to reach out.

We're happy to provide any additional details.

Thank you very much again for this opportunity!

With kind regards,

Madalin Neag

EU Policy Advisor, OpenSSF

https://openssf.org/ | https://www.linuxfoundation.org/

mneag@contractor.linuxfoundation.org