Skip to main content

Clause 5.3 — Product security by design

Subclause 5.3 defines the security by design principle in FprEN 40000-1-2:2026. Security measures must be integrated into products from the initial concept phase and maintained through the whole lifecycle.

What Clause 5.3 requires​

Manufacturers must employ proven security architecture techniques, including:

  • Least privilege: Restricting resource access to the absolute minimum necessary.
  • Attack surface minimization: Removing unneeded interfaces, ports, and protocols.
  • Defense in depth: Layering multiple security controls to eliminate single points of failure.
  • Secure coding practices: Eliminating common software defects (memory safety, injection flaws) during implementation.
  • No security by obscurity: Relying on robust mechanisms rather than hidden algorithms.
  • User-centric design: Minimizing friction while preventing security circumvention.

How CVD Portal supports compliance​

CVD Portal reinforces security by design principles across your product architecture and team workflows:

  • Architecture and design artifact tracking: The platform technical file generator captures design decisions, trust boundaries, and interface protection controls.
  • Dependency due diligence: The GitHub connector pulls the repository SBOM into the SBOM Registry. For each component, you record maintenance status, CE marking, and a fit-for-purpose decision.
  • Policy library controls: The policy library includes a secure development policy template for development teams.
  • Audit trail proof: The platform records design reviews and control verification events in a hash-chained, append-only audit log for assessment bodies.