Skip to main content

Clause 7.3 — Product cybersecurity requirements

Subclause 7.3 specifies requirements for defining and managing product cybersecurity requirements under FprEN 40000-1-2:2026.

What Clause 7.3 requires​

Requirements​

  • [CLA-02-RQ-01]: Product cybersecurity requirements shall be specified based on:
    • The product context (6.2).
    • Risk treatment decisions (6.5).
    • Applicable regulatory requirements (CRA, GDPR data minimization).
  • [CLA-02-RQ-02]: Product cybersecurity requirements shall be reviewed and updated when changes occur in inputs.

Outputs & Assessment​

  • Output: Documented specified cybersecurity requirements.
  • Assessment Criteria: PASS assigned when specified requirements documentation exists, meets all requirement criteria, and reflects current inputs.

How CVD Portal supports compliance​

CVD Portal streamlines requirements derivation and lifecycle traceability:

  • CRA Annex I control matrix: The platform maps regulatory essential requirements (vulnerability handling, risk management) directly into actionable technical requirements.
  • Policy library templates: Four policy templates cover secure development, vulnerability handling, incident response, and SBOM management.
  • Change review alerts: When the manufacturer, classification, interfaces, or intended use change, the platform marks the affected drafts as out of date.
  • Verification mapping: Each requirement links directly to verification tests and evidence files in the technical file builder.