Skip to main content

Clause 7.7 — Secure production and distribution

Subclause 7.7 specifies requirements for managing cybersecurity risks during manufacturing, digital build pipelines, and product distribution under FprEN 40000-1-2:2026.

What Clause 7.7 requires​

Digital Software Products (7.7.2)​

  • [CLA-06-RQ-01]: Software products and updates shall be protected from manipulation during transit and storage.
  • [CLA-06-RQ-02]: Measures shall include online platform authentication, integrity protection (cryptographic hashes, signatures), and release artifact authenticity.
  • [CLA-06-RQ-03]: User instructions shall be protected during distribution.
  • [CLA-06-RQ-04]: User instructions shall be delivered in an accessible manner.

Physical Products (7.7.3)​

  • [CLA-07-RQ-01]: Risks of physical product manipulation during manufacturing shall be addressed.
  • [CLA-07-RQ-02]: Measures shall include protecting work instructions, verifying firmware/software binaries before installation, restricting embedded debug features, and managing PKI/keys securely.

How CVD Portal supports compliance​

CVD Portal protects software release integrity and distribution documentation:

  • Cryptographic artifact verification: CVD Portal records a SHA-256 hash for each uploaded evidence file. You can verify the stored file against the hash.
  • Protected user documentation distribution: Public portal pages and security advisories are served over TLS with strict CSP headers.
  • Supply chain connector: The GitHub connector pulls the repository SBOM with a read-only token.
  • Distribution formats: The public portal publishes HTML pages, a plain-text security.txt, and machine-readable CSAF 2.0 advisories.