Skip to main content

Clause 7 — Lifecycle activities overview

Clause 7 specifies normative product cybersecurity lifecycle activities under FprEN 40000-1-2:2026. These activities are process-agnostic and apply across linear, iterative, and agile development methodologies.

What Clause 7 requires​

Clause 7 defines nine core lifecycle activities, tagged with normative requirement IDs (CLA-01 through CLA-10):

  1. Planning (7.2, CLA-01): Defining, maintaining, and tracking security activities across the lifecycle.
  2. Requirements (7.3, CLA-02): Specifying cybersecurity requirements derived from risk assessments and legal obligations.
  3. Architecture and design (7.4, CLA-03): Selecting security controls, trust boundaries, and secure interfaces.
  4. Secure implementation (7.5, CLA-04): Developing in a secure environment, maintaining SBOMs, and drafting user documentation.
  5. Verification and validation (7.6, CLA-05): Conducting recurring testing, analysis, and vulnerability scanning.
  6. Production and distribution (7.7, CLA-06, CLA-07): Protecting digital software and physical product integrity through market placement.
  7. Monitoring and issue management (7.8, CLA-08): Monitoring threat intelligence, handling vulnerabilities, and Article 14 incident reporting.
  8. Planning for secure decommissioning (7.9, CLA-09): Preparing secure reset, user data deletion, and end-of-support guidance.
  9. Third-party component management (7.10, CLA-10): Applying due diligence, license checks, and continuous monitoring to third-party software.

How CVD Portal supports compliance​

CVD Portal coordinates lifecycle activities across your engineering and compliance operations:

  • Lifecycle activity tracking: The Control Register assigns owners, due dates, and automated status checks to each CLA-* requirement ID.
  • Cross-activity integration: Information flows automatically between activities—for example, SBOM uploads in 7.5 feed vulnerability monitoring in 7.8 and third-party due diligence in 7.10.
  • Audit-ready technical files: The platform automatically assembles outputs from all Clause 7 activities into a unified technical file matching CRA Annex VII.