diff --git a/docs/security/00-index.md b/docs/security/00-index.md
index 2e0054eb5ea..c5fa00c26e6 100644
--- a/docs/security/00-index.md
+++ b/docs/security/00-index.md
@@ -1,5 +1,7 @@
 # Vulnerability Management and Incident Response Policy
 
+For a quick overview of how to report vulnerabilities, see the organization-wide [SECURITY.md](https://github.com/osbuild/.github/blob/main/SECURITY.md) file, which applies to all repositories under the osbuild GitHub organization.
+
 ## 1. Reporting
 
 - Report security vulnerabilities via email to [osbuilders@redhat.com](mailto:osbuilders@redhat.com).
@@ -17,3 +19,11 @@
 - Public disclosure occurs strictly after a patch is released and integrated into the primary branch.
 - A CVE identifier will be requested when appropriate.
 - The reporter will be credited in the public security advisory and release notes unless anonymity is explicitly requested.
+
+## 4. EU Cyber Resilience Act
+
+This project is stewarded by **Red Hat, Inc.**, an open source software steward as defined in Article 3(14) of the [EU Cyber Resilience Act (Regulation 2024/2847)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng). Contact: [cra-steward@redhat.com](mailto:cra-steward@redhat.com)
+
+If you become aware of an **actively exploited vulnerability** or a **severe incident** affecting this project, please report it promptly — see [Reporting Actively Exploited Vulnerabilities and Severe Incidents](https://github.com/RedHatProductSecurity/CRA/blob/main/Guidelines/eu-cra-incident-and-vulnerability-reporting-guidelines.md) for the process and timelines.
+
+For Red Hat's general security practices, see [Red Hat Product Security](https://access.redhat.com/security/).