Skip to main content

Clause 6.5 — Product cybersecurity risk treatment

Subclause 6.5 specifies requirements for treating unacceptable cybersecurity risks under FprEN 40000-1-2:2026. Risk treatment ensures residual risk falls within acceptable bounds.

What Clause 6.5 requires​

Requirements​

  • [RMA-07-RQ-01]: Each risk found unacceptable against acceptance criteria (6.4.5) shall be treated as appropriate to the product context.
  • [RMA-07-RQ-02]: The risk treatment decision and its rationale shall be documented.
  • [RMA-07-RQ-03]: After risk treatment, the risks shall be re-evaluated to determine residual risk acceptability.

Treatment mechanisms include:

  • Risk avoidance: Removing unneeded interfaces, immature libraries, or unsafe protocols.
  • Risk mitigation: Implementing technical controls to reduce likelihood or impact.
  • Risk transfer: Shifting operational responsibility to downstream integrators or users via conditions of use.

Outputs & Assessment​

  • Output: Documented treatment decisions with individual rationale per risk.
  • Assessment Criteria: PASS assigned when treatment decisions exist, align with acceptance criteria, and re-evaluation proves residual risk is acceptable.

How CVD Portal supports compliance​

CVD Portal provides end-to-end remediation decision management:

  • Remediation decision board: Product teams can assign treatment strategies (Patch, Mitigate, Transfer, Accept) directly to identified vulnerability reports.
  • Automated re-assessment triggers: When a new software build or SBOM update is uploaded, the platform automatically re-evaluates associated risk scores.
  • Upstream fix tracking: For third-party components, treatment decisions can link to upstream PRs or vendor patch releases.
  • Audit trail proof: All treatment rationales, owner assignments, and re-evaluation outcomes are recorded in an append-only audit log.