Skip to main content

Clause 5.2 — Risk-based approach to product cybersecurity

Subclause 5.2 establishes the risk-based approach principle in FprEN 40000-1-2:2026. Controls must be proportionate to the risks posed to persons, organizations, and society.

What Clause 5.2 requires​

A risk-based approach requires continuous iteration across six key activities:

  • Establishing product context (intended purpose and reasonably foreseeable use).
  • Defining risk acceptance criteria.
  • Conducting structured risk assessments evaluating impact and likelihood.
  • Applying risk treatment (mitigation, avoidance, transfer).
  • Communicating residual risks to relevant parties.
  • Monitoring and reviewing risks over the entire product lifecycle.

How CVD Portal supports compliance​

CVD Portal provides dedicated tools for each step of the risk-based loop:

  • Risk scoring: The built-in CVSS 3.1 and CVSS 4.0 calculator scores each reported vulnerability. The risk assessment scores each risk on a 5x5 likelihood and impact grid.
  • Risk assessment workspace: Product teams can document asset exposure, threat vectors, and risk acceptance justifications in a centralized dashboard.
  • Continuous risk monitoring: CVD Portal matches SBOM components against OSV advisories. It checks findings for exploitation in CISA KEV and GCVE sources. A new finding or KEV match opens a review trigger on the product.
  • Remediation tracking: You can track risk treatment decisions (patching, mitigation, acceptance) and verify residual risk acceptability before release.