Oracle is actively shaping the global cybersecurity standards landscape by participating in over 100 standards-setting organizations and more than 300 technical committees, aligning its global cloud, IT, and AI infrastructure with emerging regulations like the European Union’s Cyber Resilience Act.
Global Regulatory Alignment and International Standards
Cybersecurity compliance is increasingly driven by regulatory frameworks that establish common operational baselines across the international digital ecosystem. In Europe, these frameworks include the Digital Operational Resilience Act, the Cyber Resilience Act, the Network and Information Security (NIS2) Directive, and the Cybersecurity Certification Scheme for Cloud Services (EUCS), alongside FedRAMP in the United States. Industry groups like the Open Worldwide Application Security Project also contribute practical resources for software security.
To translate these broad policy objectives into practical engineering implementations, organizations rely on internationally recognized benchmarks such as ISO/IEC 27001:2022. Because Oracle delivers its IT, AI, and cloud services worldwide, international harmonization of these standards is essential for efficient global operations.
Oracle Engagement Across Standards Bodies
Thousands of Oracle employees participate in open-source projects and technical committees spanning security governance, cloud architecture, secure software development, and regulatory compliance. The company engages directly with organizations such as NIST, ISO/IEC, CEN-CENELEC, ETSI, the Cloud Security Alliance, the Agentic AI Foundation, OWASP, the Linux Foundation, the Eclipse Foundation, SAFECode, and the Partnership on AI.
Foundational cybersecurity and privacy standards are a primary focus of this work, particularly through participation in ISO/IEC JTC 1/SC 27, as well as ETSI and CEN-CENELEC JTC 13. These bodies focus specifically on information security, cybersecurity, and data protection standardization within Europe.
Meeting the Requirements of the EU Cyber Resilience Act
The EU Cyber Resilience Act illustrates how technical standardization and cybersecurity regulation are converging. The Act establishes a common cybersecurity framework for products with digital elements made available on the European Union market, relying on European harmonized standards to provide technical mechanisms for demonstrating conformity.
Oracle contributes technical expertise to European standards bodies developing harmonized standards registered by the European Commission. This work includes active participation within CEN-CENELEC JTC 13 on standards related to the CRA, such as the emerging prEN 40000 series, which addresses vocabulary, principles for cyber resilience, vulnerability handling, and generic security requirements.
Vulnerability and Incident Reporting Obligations
The CRA introduces compliance requirements in phases. On September 11, 2026, the regulation’s vulnerability and incident reporting obligations became applicable.
These obligations require manufacturers to report actively exploited vulnerabilities and severe security incidents affecting covered products through the European Union’s reporting framework. This reporting mechanism supports coordinated awareness, information sharing, and response across the EU cybersecurity ecosystem.
