All votes have passed on the Cyber Resilience Act (CRA). It will now become the law after a short transition period, introducing new roles and responsibilities of various stakeholders in the security of software supply chains. To help this adaptation, the Linux Foundation is developing guidance for its small and large open source projects and the wider community in implementing the CRA. In this session, we will present our assessment of the state of the art of cybersecurity best practices in leading open source projects and our analysis of the gaps to the requirements of the CRA. Then, we will introduce our three multi-year work streams covering the required adaptation of the open source ecosystem for compliance with the CRA: 1) formalizing community best practices into standards, 2) building awareness within the open source ecosystem, and 3) implementing the required processes and tooling. Many of these changes will require deeper collaboration between the manufacturers of products with digital elements and the upstream communities and stewards. We will provide an overview of the Linux Foundation’s CRA implementation roadmap developed and discuss how the CRA shapes the future of the relationship between manufacturers and upstream communities.