# Ansible CRA Stewardship Update - Light Compliance **URL:** \ **Category:** Project Discussions\ **Tags:** infra-and-security, cra\ **Created:** [September 11, 2026, 2:39pm UTC](https://forum.ansible.com/t/ansible-cra-stewardship-update-light-compliance/46295 "2026-09-11T14:39:41Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![dbrennand](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dbrennand/32/7830_2.png) [@dbrennand](https://forum.ansible.com/u/dbrennand)\ **Post date:** [September 11, 2026, 2:39pm UTC](https://forum.ansible.com/t/ansible-cra-stewardship-update-light-compliance/46295/1 "2026-09-11T14:39:41Z")
Hi Ansible Community! Welcome back to our [ongoing series](https://forum.ansible.com/tag/cra/513) on the **EU Cyber Resilience Act (CRA)**. Today’s post is a short update on the stewardship status of the Ansible project. We are happy to report that, as of last week, we are officially ‘light-compliant’ meaning we meet the baseline criteria under the CRA! 🎉 Let’s go into some of the changes made in recent months. ### New pages on [docs.ansible.com](http://docs.ansible.com) There are three new pages on [docs.ansible.com](http://docs.ansible.com): - [Ansible vulnerability management and incident response policy](https://docs.ansible.com/projects/ansible-core/devel/community/vulnerability_management_policy.html) - [Ansible security policy](https://docs.ansible.com/projects/ansible-core/devel/community/security_policy.html) - [Secure development practices](https://docs.ansible.com/projects/ansible-core/devel/community/secure_development_practices.html) At a high level, all three documents cover how the Ansible ecosystem prevents vulnerabilities through secure development practices, manages the reporting and triage of security issues, handles the response and disclosure processes, and uses files like SECURITY.md to guide these practices. Thank you to everyone who reviewed the pull requests for these new pages! ### ansible.com/security Updated Redirect [ansible.com/security](http://ansible.com/security) now redirects to the [Ansible security policy](https://docs.ansible.com/projects/ansible-core/devel/community/security_policy.html) for easier discoverability of the new policy. ### SECURITY.md File Rollout A standard [SECURITY.md](https://docs.ansible.com/projects/ansible-core/devel/community/security_policy.html#the-security-md-file) file has been rolled out to all GitHub organizations listed in the [security policy](https://docs.ansible.com/projects/ansible-core/devel/community/security_policy.html#github) using the special [.github](https://github.com/ansible-community/.github) repository. This change ensures that anyone viewing a repository on GitHub will see the [SECURITY.md](https://docs.ansible.com/projects/ansible-core/devel/community/security_policy.html#the-security-md-file) file. Furthermore, if you are a collection maintainer or maintainer of a repository under one of the GitHub organizations listed in the [security policy](https://docs.ansible.com/projects/ansible-core/devel/community/security_policy.html#github), you may have noticed a PR to either add, or update the [SECURITY.md](https://docs.ansible.com/projects/ansible-core/devel/community/security_policy.html#the-security-md-file) file - bringing it in line with the standard Ansible project template. ### CI Hardening Several GitHub Action workflows across critical Ansible repositories have been hardened with pinning to reduce risk of supply chain compromise. Thank you to the community members that have contributed and reviewed these changes to secure the software supply chain! Amazing work! ❤ 🔒 - [Harden release workflow: split up build step by felixfontein · Pull Request #726 · ansible-community/ansible-build-data · GitHub](https://github.com/ansible-community/ansible-build-data/pull/726) - [Workflows: restrict permissions by felixfontein · Pull Request #163 · ansible-community/images · GitHub](https://github.com/ansible-community/images/pull/163) - [Harden release workflow by splitting build step into build and create PR step · Issue #725 · ansible-community/ansible-build-data · GitHub](https://github.com/ansible-community/ansible-build-data/issues/725) - [Chore: Pin actions to specific SHA-1 commit by carlbuchmann · Pull Request #131 · ansible-community/ansible-test-gh-action · GitHub](https://github.com/ansible-community/ansible-test-gh-action/pull/131) - [CI: Pin all actions not under control by gh.com/ansible-community by felixfontein · Pull Request #711 · ansible-community/ansible-build-data · GitHub](https://github.com/ansible-community/ansible-build-data/pull/711) ### Call to Action If you see a [SECURITY.md](https://docs.ansible.com/projects/ansible-core/devel/community/security_policy.html#the-security-md-file) PR come your way, we’d appreciate your support with getting it merged! 🙂 Also, join the discussion in [Pinning GHA actions/shared workflows to commits - #2 by felixfontein](https://forum.ansible.com/t/pinning-gha-actions-shared-workflows-to-commits/46118/2) where there are open questions about pinning shared GitHub Action workflows. If you’d like to read more about the other posts in the CRA series, see also: - [Securing the Supply Chain Together: Security Concepts Every Ansible Contributor Should Know](https://forum.ansible.com/t/securing-the-supply-chain-together-security-concepts-every-ansible-contributor-should-know/46021/1) - [Security as Default, Not an Afterthought: The CRA's Real Message](https://forum.ansible.com/t/security-as-default-not-an-afterthought-the-cras-real-message/45795/1) - [EU Cyber Resilience Act (CRA) and what it means for Ansible?](https://forum.ansible.com/t/eu-cyber-resilience-act-cra-and-what-it-means-for-ansible/45716/1)