Skip to main content

Clause 6.5 — Product cybersecurity risk treatment

Subclause 6.5 specifies requirements for treating unacceptable cybersecurity risks under FprEN 40000-1-2:2026. Risk treatment ensures residual risk falls within acceptable bounds.

What Clause 6.5 requires​

Requirements​

  • [RMA-07-RQ-01]: Each risk found unacceptable against acceptance criteria (6.4.5) shall be treated as appropriate to the product context.
  • [RMA-07-RQ-02]: The risk treatment decision and its rationale shall be documented.
  • [RMA-07-RQ-03]: After risk treatment, the risks shall be re-evaluated to determine residual risk acceptability.

Treatment mechanisms include:

  • Risk avoidance: Removing unneeded interfaces, immature libraries, or unsafe protocols.
  • Risk mitigation: Implementing technical controls to reduce likelihood or impact.
  • Risk transfer: Shifting operational responsibility to downstream integrators or users via conditions of use.

Outputs & Assessment​

  • Output: Documented treatment decisions with individual rationale per risk.
  • Assessment Criteria: PASS assigned when treatment decisions exist, align with acceptance criteria, and re-evaluation proves residual risk is acceptable.

How CVD Portal supports compliance​

CVD Portal provides end-to-end remediation decision management:

  • Remediation decision board: Product teams record a remediation decision (Fix, Workaround, Accept, Transfer, or Defer) on each vulnerability report.
  • Automated re-assessment triggers: A new SBOM finding or CISA KEV match opens a review trigger on the product. You close the trigger with a recorded outcome.
  • Upstream fix tracking: For third-party components, the upstream report on a vulnerability can link to the upstream security fix.
  • Audit trail proof: All treatment rationales, owner assignments, and re-evaluation outcomes are recorded in an append-only audit log.