Skip to main content

Clause 7.2 — Product cybersecurity planning

Subclause 7.2 specifies requirements for product cybersecurity planning under FprEN 40000-1-2:2026. Planning describes and tracks all security activities throughout a product's lifecycle.

What Clause 7.2 requires​

Requirements​

  • [CLA-01-RQ-01]: Product cybersecurity planning shall cover at least applicable activities in Clause 6 (risk management) and subclauses 7.3 through 7.10 (lifecycle activities).
  • [CLA-01-RQ-02]: For the complete product lifecycle, cybersecurity planning activities shall:
    • Be maintained and reviewed on a regular basis.
    • Have their execution tracked.

Inputs & Outputs​

  • Input: Product context output from 6.2.
  • Output: Documented product cybersecurity plan covering all required activities.
  • Assessment Criteria: PASS assigned when documented planning exists, covers all mandatory clauses, and includes active execution tracking.

How CVD Portal supports compliance​

CVD Portal turns static security plans into actionable, trackable workspace workflows:

  • Plan drafting: You can draft the cybersecurity planning document (C7.2-OUT-01) from the Clause 6 outputs.
  • Ownership and due-date management: On the Controls page, you can assign colleagues as owners of each control and set due dates in UTC.
  • Progress tracking: The Controls page shows a daily readiness trend. You can filter for overdue or unassigned controls.
  • Audit trail proof: The platform logs owner and due-date changes with user identity and timestamp.