8:30 – 9:00
Registration
9:00 – 9:30
ENISA AHWG, CEN-CENELEC
The power of standards: Making CRA work for everyone
In this session, Linnéa explores how standards can make the Cyber Resilience Act not only workable, but genuinely beneficial for everyone involved — from developers and security teams to product owners, legal, and leadership. With a focus on inclusion and collaboration, she shows how well‑designed standards reduce complexity, create shared understanding, and help organizations navigate CRA without feeling overwhelmed.
The talk clarifies when CRA requires the use of standards, when it doesn’t, and why following them voluntarily can still strengthen trust and raise the quality bar. Linnéa also provides an overview of the current status of CRA‑related standards and what to expect next. Participants will leave with new insights, a positive and accessible understanding of CRA, and a clear sense of how standards can support both compliance and long‑term resilience.
9:30-10:00
Shift security left: How to integrate cyber security professionals early in the process
Energi-CERT was formed to facilitate and accelerate collaboration and collective action within cybersecurity for the entire Swedish energy sector. At first glance the main challenge is to coordinate and share information across 200 very different companies (size, geography, corporate culture, security awareness). But it is also just as much bridging the gap between cyber security professionals and other functions within respective company.
10:00-10:30
To be announced
10:30-11:00
Tea break
11:00-11:30
Your Vendors Are Now a Legal Problem: Running Third-Party Security Reviews Under CRA, NIS2 and DORA
For years, vendor security review meant a spreadsheet, a few email threads, and no clear owner. Three EU regulations just made it a legal duty.
The Cyber Resilience Act turns every software supplier into a producer of security evidence: SBOMs, VEX, and conformity documentation. NIS2 Article 21 and DORA Articles 28 to 30 then require the companies buying that software to assess their suppliers and prove they did it.
This talk shows the practical method that connects the two sides. It covers how to triage vendors by criticality, how to turn supplier artifacts into a defensible assessment instead of a questionnaire, and how to map concentration risk before a regulator or an incident finds it first.
The takeaway is a repeatable way to run third-party security reviews under CRA, NIS2 and DORA, drawn from building this exact workflow for EU-regulated fintechs.
11:30-12:00
Implementing Supply Chain Best Practices in the Open Source World
Supply chain best practices are a necessity in the current world, and even more at Ericsson, with the entry of Cyber Resillience Act (CRA) and update to the NIST CSF 2.0.
Ericsson maintains and develops Erlang/OTP, an open source project that has been alive for 40 years, which is used also by well-known companies, such as WhatsApp, Cisco, Klarna, Kivra, and Discord, among others.
In this presentation, Kiko (core member of Erlang/OTP) provides a deep dive into how the Erlang/OTP team has lead the implementation of supply-chain best practices for the BEAM community, with support from the Erlang Ecosystem Foundation.
12:00-12:30
Nobody Wants Your Maturity Model
OWASP SAMM is an excellent tool for improving an organization’s application security program, but developers often didn’t ask for it. Handed down as a scorecard, it lands as an audit, and the result is polite compliance at best and quiet resistance at worst. As software consultants and strong believers in SAMM, we set out to change how it arrives, treating the development team as the user of the model rather than its subject. We share what we learned about making maturity work accessible and empowering, and why that matters even more under the Cyber Resilience Act.
12:30-13:30
Lunch
13:30-14:00
The New EU Open Source Strategy and Tech Sovereignty
The EU Open Source Strategy from June 2026 places open source at the centre of the EU’s technological sovereignty by promoting European open alternatives to non-EU proprietary solutions in critical domains.
The Strategy aims to strengthen Europe’s open digital ecosystems by supporting the development, scaling, deployment and long-term sustainability of open source technologies across both the public and private sectors.
The strategy is embedded in the broader Communication on European Technological Sovereignty, part of the EU Digital Sovereignty Package, alongside initiatives such as the proposal for a Cloud and AI Development Act, the proposal for a Chips Act 2.0, and the Strategic Roadmap for Digitalisation and AI in Energy.
Johanna Parikka Altenstedt sorts out the different legal initiatives and components, and explains how they together aim to create a coherent framework for Europe’s digital infrastructure, strengthening resilience, competitiveness and strategic autonomy and thus innovation in EU.
14:00-14:30
OSPO – Your Guide in the Dark
The OSPO, Open Source Program Office, guides your organisation in the software supply chain. The purpose is to provide clear policies and processes for software in-take, but also to ensure that the software developed is compliant. This has always been important, but is extra relevant today because of CRA.
In this talk, Johan exemplifies the scope of an OSPO, highlights common pitfalls and discusses where the community lives.
14:30-15:00
To be announced
To be announced
15:00-15:30
Break
After the break, single track session. Check track 1
Conference partners
Organiser
