Skip to main content

Clause 7.5 — Secure implementation

Subclause 7.5 specifies requirements for secure implementation activities during product development under FprEN 40000-1-2:2026.

Portal UI Path: CVD Portal → Supply Chain → SBOM Registry / CRA Portal → Products → [Select Product] → Requirements

Related Procedures:

What Clause 7.5 requires​

Requirements​

  • [CLA-04-RQ-01]: Products shall be developed and maintained in a secure development environment preventing unauthorized access.
  • [CLA-04-RQ-02]: All cybersecurity requirements (7.3) per architecture/design (7.4) shall be implemented.
  • [CLA-04-RQ-03]: Integrated component lists shall be identified and maintained.
  • [CLA-04-RQ-04]: An SBOM appropriate for the product shall be created and maintained in a machine-readable format.
  • [CLA-04-RQ-05]: Technical documentation (CRA Annex VII) shall be prepared.
  • [CLA-04-RQ-06]: User information and instructions (CRA Annex II) shall be prepared.
  • [CLA-04-RQ-07]: Implementation deviations from design documentation shall trigger risk management (6.7) and lifecycle reviews.

How CVD Portal supports compliance​

CVD Portal automates implementation evidence collection and SBOM management:

SBOM Registry in CVD Portal

  • SBOM Registry: Ingests, parses, and validates CycloneDX, SPDX, and TR-03183 machine-readable SBOM formats.
  • Automated fresh checks: Checks run daily to verify your stored SBOM has been updated within 90 days.
  • CRA Annex VII technical file compiler: Automatically gathers component lists, risk assessments, and policy documentation into an exportable ZIP archive.

Sample Machine-Readable CycloneDX SBOM Output Snippet (CLA-04-RQ-04)​

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69f99",
  "version": 1,
  "metadata": {
    "component": {
      "type": "firmware",
      "name": "ACME Secure Gateway Firmware",
      "version": "2.1.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "openssl",
      "version": "3.0.13",
      "purl": "pkg:generic/[email protected]"
    }
  ]
}