Skip to main content

Clause 6.7 — Product cybersecurity risk review

Subclause 6.7 specifies requirements for reviewing and updating product cybersecurity risk management activities under FprEN 40000-1-2:2026. Risk review ensures security stays aligned with evolving threats.

What Clause 6.7 requires​

Requirements​

  • [RMA-09-RQ-01]: Risk management activities shall be reviewed at planned intervals based on risk assessment and product context.
  • [RMA-09-RQ-02]: Risk reviews shall also be triggered by specific events:
    • Product modifications impacting cybersecurity.
    • Product context or risk acceptance criteria changes.
    • Risk exposure changes (threat landscape shifts).
    • Discovery of known exploitable or actively exploited vulnerabilities.
    • Severe cybersecurity incidents.
    • Component obsolescence impacting product security.
  • [RMA-09-RQ-03]: If impacted, relevant risk assessment documentation shall be updated.

Outputs & Assessment​

  • Output: Documentary evidence of completed reviews and updated Clause 6 documentation.
  • Assessment Criteria: PASS assigned when review records exist and updated documentation addresses the review triggers.

How CVD Portal supports compliance​

CVD Portal automates both periodic and event-triggered risk reviews:

  • Automated threat triggers: A new SBOM finding, a CISA KEV match, or a triaged vulnerability report opens a review trigger on the affected product.
  • Substantial modification tracking: The product Monitoring tab has a substantial modification assessment. It uses the four factors in Commission guidance C(2026) 5252.
  • Scheduled review cadences: Automated checks monitor documentation freshness. They warn you when a quarterly or semi-annual review deadline approaches.
  • Versioned technical file records: You can take a dated snapshot of the assessment and compare two snapshots.