Skip to main content

Clause 7.9 — Planning for secure decommissioning

Subclause 7.9 specifies requirements for preparing products and remote data processing solutions (RDPS) for secure reset, retirement, or end-of-support under FprEN 40000-1-2:2026.

What Clause 7.9 requires​

Requirements​

  • [CLA-09-RQ-01]: Manufacturers shall prepare for secure decommissioning, accounting for:
    • Decommissioning cybersecurity considerations.
    • Confidential assets (user data, settings, cryptographic keys) needing secure deletion and their logical locations.
    • Required manufacturer or third-party actions to ensure secure decommissioning.
    • User instructions and notification methods regarding decommissioning.
    • Remaining manufacturer activities at and beyond end of support.
  • [CLA-09-RQ-02]: User decommissioning instructions shall specify:
    • Data removal mechanisms ("Factory Reset", "Secure Erase").
    • User data export methods.
    • Cybersecurity asset removal (security configuration data).
    • Removal from operational environments.
    • Secure hardware disposal to prevent data disclosure.
    • Automated data deletion details (what and when).

Outputs & Assessment​

  • Output: Documented user communication methods, manufacturer preparation activities, and user instructions.
  • Assessment Criteria: PASS assigned when decommissioning documentation exists and satisfies all mandatory instruction items.

How CVD Portal supports compliance​

CVD Portal manages support period commitments and decommissioning documentation:

  • Support period registry: Tracks product support dates and triggers automated alerts before end-of-support milestones arrive.
  • Decommissioning policy templates: Policy library provides standardized user instructions for factory resets, data export, and secure disposal.
  • Public end-of-support notices: Trust Portal and user advisory pages publish end-of-support dates and migration guidance for customers.
  • RDPS data purge workflows: Workspace settings provide automated data deletion and tenant offboarding options complying with GDPR and CRA requirements.