Dear Apache Software Foundation,
Thermo Fisher Scientific is conducting an
enterprise-wide assessment of supply chain cybersecurity risk to support
compliance with the EU Cyber Resilience Act (EU-CRA). The EU-CRA introduces
mandatory cybersecurity requirements for products with digital elements made
available on the EU market. The regulation applies to manufacturers (including
software developers), importers, and distributors, regardless of geographic
origin, and requires documented evidence of cybersecurity risk management and
supply chain security controls. Because our products are reasonably expected to
operate in networked environments, we must assess the cybersecurity and supply
chain controls associated with products and software provided by our
suppliers. Action Required: Please review the requirements and provide the requested confirmation with supporting documentation via HERE by October 13, 2026. This assessment is part of Thermo Fisher
Scientifics supplier risk evaluation framework and may affect sourcing
decisions and EU market eligibility. Follow-up reviews may be required.
Thank you
for your cooperation. If you have questions, please contact [email protected].
Sincerely, Global
Procurement Thermo
Fisher Scientific |
--------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
