Skip to main content

Clause 1 — Scope

Clause 1 defines the scope of FprEN 40000-1-2:2026. This horizontal draft standard specifies generic product cybersecurity principles, baseline risk management requirements, and lifecycle activities for products with digital elements.

What Clause 1 requires​

The standard applies to all products with digital elements across their full lifecycle, from concept and design to decommission. It also provides the baseline framework for product-category vertical standards developed under European Commission standardization request M/606.

Clause 1 establishes three core coverage areas:

  • Generic cybersecurity principles for all interested parties.
  • Baseline requirements to manage product cybersecurity risks.
  • Lifecycle requirements to maintain product security from development to end of support.

How CVD Portal supports compliance​

CVD Portal provides an end-to-end compliance workspace that covers the full product lifecycle:

  • Full lifecycle coverage: You can manage product security from initial product context definition through active vulnerability monitoring to end-of-support decommissioning.
  • Product compliance workspace: Every registered product gets a dedicated workspace that aligns risk assessment, SBOM component tracking, and technical file generation with CRA Annex I Part I requirements.
  • Vertical standard alignment: The product classifier helps you select the Annex III or Annex IV category. It then shows the vertical standard that covers that category (such as an ETSI EN 304 standard or a CEN-CENELEC standard).
  • Continuous readiness tracking: Scheduled automated checks test your live setup, for example your security.txt, SBOM age, and review dates. Each check gives a PASS or FAIL result on the related control.