Skip to main content

Clause 7.10 — Third-party component cybersecurity management

Subclause 7.10 specifies requirements for due diligence, risk assessment, and continuous monitoring of third-party commercial and open-source (FOSS) components under FprEN 40000-1-2:2026.

What Clause 7.10 requires​

Requirements​

  • [CLA-10-RQ-01]: Due diligence shall be performed on third-party components during selection and prior to integration into products.
  • [CLA-10-RQ-02]: Third-party components and their integration shall be included in risk assessment and treatment activities (Clause 6).
  • [CLA-10-RQ-03]: Third-party components shall be securely implemented and integrated (7.5).
  • [CLA-10-RQ-04]: Third-party components shall be validated and verified (7.6).
  • [CLA-10-RQ-05]: Third-party components shall be monitored over their lifecycle to identify and address relevant vulnerabilities (7.8).

Due diligence checks include:

  • Assessing intended purpose alignment.
  • Checking for CRA CE marking or EU Declaration of Conformity where available.
  • Verifying absence of known vulnerabilities in databases (e.g., EUVD).
  • Assessing patch availability and vulnerability handling processes.
  • Evaluating FOSS project maintenance activity, open-source stewards, and security practices.
  • Upstream fix contribution (submitting patches back to original projects).

Outputs & Assessment​

  • Output: Documented evidence of third-party component due diligence, risk integration, testing, and lifecycle monitoring.
  • Assessment Criteria: PASS assigned when documented due diligence evidence exists and satisfies requirement criteria.

How CVD Portal supports compliance​

CVD Portal automates third-party supply chain due diligence and vulnerability management:

  • SBOM Registry: Ingests CycloneDX and SPDX SBOMs and lists all third-party components.
  • Automated vulnerability matching: Matches components against OSV advisories. It checks findings for exploitation in CISA KEV and GCVE sources. On the Enterprise plan, a daily job rescans every SBOM.
  • FOSS maintenance records: For each component, you record maintenance status (for example unmaintained or end of life), CE marking, and a fit-for-purpose decision.
  • Upstream reporting connector: Allows you to report discovered third-party vulnerabilities to upstream maintainers or vendor security contacts directly from the vulnerability report.