Skip to main content

Annex B — Accessible and inclusive cybersecurity

Annex B (informative) addresses accessible and inclusive cybersecurity, linking product security requirements to the European Accessibility Act (Directive (EU) 2019/882) and EN 301 549.

What Annex B requires​

Security features are often the "front door" to digital products. Inaccessible authentication, complex consent dialogues, or fast-disappearing pop-up alerts exclude users with visual, hearing, motor, or cognitive impairments.

Key accessibility guidelines include:

  • Avoiding single-method authentication: Providing accessible alternatives (e.g., audio CAPTCHAs, logical puzzles instead of distorted text).
  • Flexible time-outs: Extending password entry time-outs for users relying on switch devices or screen readers.
  • EN 301 549 functional performance alignment: Ensuring high-contrast UI, text resizing, keyboard navigation, and non-auditory alert alternatives (Table B.1).
  • Plain language communication: Explaining security features, risks, and updates in clear, simple language without technical jargon.
  • Risk assessment inclusion: Accounting for accessibility features during risk assessments, as adding accessibility options can introduce new attack surfaces.

How CVD Portal supports compliance​

CVD Portal is built with accessibility as a core engineering principle:

  • WCAG 2.2 AA compliant public portal: The researcher submission form and public security pages meet WCAG 2.2 AA contrast, screen reader, and keyboard navigation requirements.
  • Multi-modal notification options: Alerts and advisories can be delivered via email, CSAF JSON, webhooks, and visual dashboards.
  • Plain language advisory generator: AI-assisted advisory tools draft security release notes in clear, non-technical language accessible to all user demographics.
  • Accessibility risk tracking: You can log accessibility testing results (cognitive walkthroughs, screen reader checks) directly in the V&V technical file.