@Di4na The proposed legislation puts the onus on the end vendor to warrant that their (commercial) product is cyber resilient, with heavy financial penalties if it proves otherwise. This will in turn require them to verify that all FOSS they use in their product(s), is sufficiently robust - which presumably will incur cost/fees. It's a *huge* challenge, I agree with you, and I'm uncertain whether policy makers understand the implications -- hence current call for public comment is critical.