Skip to main content

Clause 7.7 — Secure production and distribution

Subclause 7.7 specifies requirements for managing cybersecurity risks during manufacturing, digital build pipelines, and product distribution under FprEN 40000-1-2:2026.

What Clause 7.7 requires​

Digital Software Products (7.7.2)​

  • [CLA-06-RQ-01]: Software products and updates shall be protected from manipulation during transit and storage.
  • [CLA-06-RQ-02]: Measures shall include online platform authentication, integrity protection (cryptographic hashes, signatures), and release artifact authenticity.
  • [CLA-06-RQ-03]: User instructions shall be protected during distribution.
  • [CLA-06-RQ-04]: User instructions shall be delivered in an accessible manner.

Physical Products (7.7.3)​

  • [CLA-07-RQ-01]: Risks of physical product manipulation during manufacturing shall be addressed.
  • [CLA-07-RQ-02]: Measures shall include protecting work instructions, verifying firmware/software binaries before installation, restricting embedded debug features, and managing PKI/keys securely.

How CVD Portal supports compliance​

CVD Portal protects software release integrity and distribution documentation:

  • Cryptographic artifact verification: CVD Portal supports recording cryptographic hashes (SHA-256) and PGP signatures for published software update packages.
  • Protected user documentation distribution: Public user instructions and security advisories are served over TLS with strict CSP headers and integrity checks.
  • Supply chain connector: GitHub integration verifies release tag authenticity, commit signatures, and build pipeline integrity.
  • Accessible distribution formats: Public portal documentation is formatted in WCAG 2.2 AA compliant HTML, plain text, and machine-readable CSAF 2.0 formats.