Skip to main content

Clause 5.2 — Risk-based approach to product cybersecurity

Subclause 5.2 establishes the risk-based approach principle in FprEN 40000-1-2:2026. Controls must be proportionate to the risks posed to persons, organizations, and society.

What Clause 5.2 requires​

A risk-based approach requires continuous iteration across six key activities:

  • Establishing product context (intended purpose and reasonably foreseeable use).
  • Defining risk acceptance criteria.
  • Conducting structured risk assessments evaluating impact and likelihood.
  • Applying risk treatment (mitigation, avoidance, transfer).
  • Communicating residual risks to relevant parties.
  • Monitoring and reviewing risks over the entire product lifecycle.

How CVD Portal supports compliance​

CVD Portal provides dedicated tools for each step of the risk-based loop:

  • Context-aware risk scoring: The built-in CVSS v3.1/v4.0 calculator estimates vulnerability impact and likelihood based on product operational context.
  • Risk assessment workspace: Product teams can document asset exposure, threat vectors, and risk acceptance justifications in a centralized dashboard.
  • Continuous risk monitoring: CVD Portal automatically feeds live vulnerability intelligence from EUVD, GCVE, and CISA KEV into your product risk profile.
  • Remediation tracking: You can track risk treatment decisions (patching, mitigation, acceptance) and verify residual risk acceptability before release.