Order No. 834 effect on SBOM

[Panometric]

Users of Espressif products are concerned that Order 834 will make it impossible to comply with EU CRA and US Cyber Trust Mark requirements because it will be impossible to verify the source of software components critical to the operation of the device. This law went into effect immediately so there is no grace period.

What does Espressif intend to do to make sure US an EU vendors who need these certifications in their markets can continue to use these products?

https://iotm2mcouncil.org/iot-library/n ... ol-of-iot/

[ESP_Rachel]

At present, our understanding is that Order No. 834 does not explicitly prohibit SBOM disclosure. Therefore, we do not currently see a direct conflict between Order No. 834 and the requirements of the EU CRA or the US Cyber Trust Mark. As the Order 834 regulation is still relatively principles-based, and we are continuing to monitor further implementation guidance and regulatory developments.