ETSI Security Conference 2026

ETSI Security Conference 2026
19 October 2026 09:00 – 22 October 2026 18:00
Sophia Antipolis, France

ETSI’s annual flagship event on Cyber Security, the ETSI Security Conference, will take place from 19 to 22 October 2026 in Sophia Antipolis, France. 

This special anniversary edition will feature an intensive 4 day programme bringing together speakers and attendees from government organisations, standards bodies, academia and a wide range of industry sectors.

 

Cyberstand.eu at the ETSI Security Conference 2026

 

DOWNLOAD THE SLIDES

 

CYBERSTAND.eu is taking part in the 20th edition of the ETSI Security Conference. Silvana Muscella (Trust-IT Services) will moderate the "EUSR CRA Panel Session" on the final day of the conference. The panel brings together the main actors working to make the Cyber Resilience Act (CRA) work in practice.

Moderating this panel continues our work to connect standards makers, regulators, industry, SMEs and open-source communities around CRA implementation.

 

Session D4-3: EUSR CRA Panel Session – Successes and Challenges of CRA compliance

📅 Thursday 22 October 2026, 11:50-12:50 CEST
📍 ETSI, Sophia Antipolis, France

Moderator: Silvana Muscella, Trust-IT Services CEO and CYBERSTAND.eu.

Panellists:

  • Luis Miguel Vega Fidalgo, DG CNECT, European Commission: the regulator’s view on conformity assessment and market surveillance
  • Sandra Feliciano, Chair of the ETSI CYBER EUSR Working Group: progress on the CRA harmonised standards
  • Vassiliki Gogou, ENISA: the European cybersecurity standardisation landscape
  • Sonia Compans, STMicroelectronics: compliance options for industry
  • Davide Pratone, ETSI STF 725: how the EU Cybersecurity Certification scheme (EUCC) and the CRA fit together
  • Juan Rico, Eclipse Foundation: how open-source communities are putting the CRA into practice
  • George Sharkov, SBS / European DIGITAL SME Alliance: the challenges and needs of SMEs

 

This panel asks how the remaining challenges of Cyber Resilience Act (CRA) compliance can be overcome in the next 15 months. It brings together contrasting views from the European Commission, ENISA, the European Standardisation Organisations, industry, SMEs and the open-source community.

The discussion follows on from Session D4-2 on the state of play of the CRA. It reviews what has been achieved so far, from progress on the harmonised standards to the first lessons on conformity assessment and market surveillance. It also looks at where the real obstacles remain, including the interplay with EU cybersecurity certification and the specific difficulties faced by smaller companies and open-source projects.

The CRA’s vulnerability and incident reporting obligations already apply, and most of its requirements will apply from December 2027. From then on, every product with digital elements placed on the EU market will have to meet the regulation’s cybersecurity requirements throughout its lifecycle. Harmonised standards are the main practical route for manufacturers to demonstrate compliance, so their timely completion and uptake will decide whether the market is ready.

This affects large manufacturers and component suppliers, and it is even more pressing for SMEs and open-source communities with limited resources. Aligning the views of regulators, standards makers and the companies that must apply the rules is therefore essential to make the CRA work in practice.

By attending the session, participants will get a clear, up-to-date picture of the CRA timeline and what it means for their organisation, how harmonised standards can be used to reach presumption of conformity and what support is available for SMEs and open-source projects. 

 

CRA Compliance resources shared during the session:

 

READ MORE