Skip to main content

Clause 6.6 — Product cybersecurity risk communication

Subclause 6.6 specifies requirements for communicating product cybersecurity risks to users under FprEN 40000-1-2:2026. Users must receive clear information regarding transferred residual risks and required mitigation actions.

Portal UI Path: CVD Portal → Remediation → CSAF Export & User Advisories

Related Reference: Exporting CSAF 2.0 Advisories

What Clause 6.6 requires​

Requirements​

  • [RMA-08-RQ-01]: Risk communication shall meet user communication needs, providing consumer information in clear, non-technical language where possible.
  • [RMA-08-RQ-02]: Risk communication shall consider accessibility aspects (simple language, multi-modal formats).
  • [RMA-08-RQ-03]: User risk communication shall include:
    • Disclosure of context circumstances and foreseeable misuse leading to significant risks.
    • Recommended user mitigation measures (operational environment, integration requirements).
    • Conditions of secure use.

Outputs & Assessment​

  • Output: Documented disclosure of risk circumstances, conditions of use, and communicated user mitigations (C6.6-OUT-01).
  • Assessment Criteria: PASS assigned when documented risk disclosures exist and fulfill all communication and accessibility criteria.

How CVD Portal supports compliance​

CVD Portal automates clear, multi-channel security communication:

  • CSAF 2.0 / VEX exporter: Exports machine-readable advisories with plain-language remediation instructions for end users and integrators.
  • Public user advisories: Generates web-accessible, WCAG 2.2 AA compliant security advisories hosted on your company portal.
  • Policy library distribution: Provides pre-written conditions-of-use templates and security instructions formatted for ordinary consumer understanding.

Sample CSAF 2.0 Output Snippet (C6.6-OUT-01)​

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "title": "Security Advisory for ACME Router Firmware v2.1",
    "publisher": { "category": "vendor", "name": "ACME Security Team" }
  },
  "product_tree": {
    "full_product_names": [
      { "product_id": "CSAFPID-0001", "name": "ACME Router Firmware v2.1.0" }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-12345",
      "notes": [
        {
          "category": "description",
          "text": "Buffer overflow in administrative web interface when remote access is enabled."
        },
        {
          "category": "remediation",
          "text": "Upgrade firmware to version 2.1.1 or disable remote administration in network settings."
        }
      ]
    }
  ]
}