EN 40000-1-1:2026
(Main)Cybersecurity requirements for products with digital elements - Part 1-1: Vocabulary
- Abstract
This document provides the terms and definitions commonly used in the cybersecurity requirements for products with digital elements family of standards.
- Status
- Not Published
- Publication Date
- 24-Nov-2026
- Technical Committee
- CEN/CLC/TC 13 - Cybersecurity and Data Protection
- Drafting Committee
- CEN/CLC/JTC 13/WG 9 - Special Working Group on Cyber Resilience Act
- Current Stage
- 5060 - Closure of Vote - Formal Approval
- Start Date
- 01-Oct-2026
- Due Date
- 12-Oct-2026
- Completion Date
- 01-Oct-2026
EN 40000-1-1:2026 is the CEN vocabulary standard for the cybersecurity requirements for products with digital elements family. It defines the common terms and definitions used across that family, so engineers, quality managers, buyers, and other users can read the related standards with the same meaning. It is a terminology document, not a product test or performance standard.
What does EN 40000-1-1:2026 specify?
EN 40000-1-1:2026 specifies the shared vocabulary for the cybersecurity requirements for products with digital elements family of standards. Its purpose is to align language across the family, so later documents can use the same terms consistently.
The document is organized as a short terminology standard:
- European foreword - explains the drafting body and approval context.
- Introduction - explains why a common language is needed.
- 1 Scope - states the family-wide vocabulary purpose.
- 2 Normative references - no normative references are given.
- 3 Terms and definitions - the main vocabulary list.
- Bibliography - lists the source standards used for several definitions.
What are the key requirements of EN 40000-1-1:2026?
The key content of EN 40000-1-1:2026 is Clause 3, which fixes the meaning of the vocabulary used throughout the family. Clause 3 says the terms and definitions given in Regulation (EU) 2024/2847 apply, and then adds the definitions needed for this standard.
The most important defined concepts
- acceptable risk (3.1) ties risk acceptance to intended and reasonably foreseeable use, the state of the art, user health and safety, and other security objectives. In practice, teams need a shared basis for deciding when remaining risk is acceptable.
- advisory (3.3) is a document or message that provides vulnerability information intended to reduce risk. This is the basis for communicating vulnerability notices and remediation guidance.
- remediation (3.12) is a change made to a product or service to remove or mitigate a vulnerability. In practice, this covers fixes such as patches, configuration changes, or source code changes.
- reporter (3.13) is the person or organization that notifies a vendor or coordinator of a potential vulnerability. This supports vulnerability disclosure processes that accept reports from many kinds of sources.
- residual cybersecurity risk (3.14) is the cybersecurity risk remaining after risk treatment. This is the risk that still has to be accepted, monitored, or further reduced.
- security objective / cybersecurity objective (3.15) is the result to be achieved concerning protection from cyber threats. It gives teams a way to state what the controls are meant to achieve.
- product control (3.11) is a measure on a product that modifies risk. In practice, this is the product-side security control that reduces exposure.
- authenticity, availability, confidentiality, and integrity (3.5 to 3.8) are the core security properties used throughout the family. They matter because later requirements often depend on which of these properties must be protected.
Other useful terms in the vocabulary
Clause 3 also defines asset, likelihood, online hosting location, and software package. These terms support risk assessment, hosted services, and software supply discussions across the family.
What terms does EN 40000-1-1:2026 define?
- acceptable risk - risk judged acceptable for the intended and reasonably foreseeable use of a product with digital elements.
- advisory - a notice or message used to share vulnerability information and reduce risk.
- asset - anything that has value to an individual, an organization, or a government.
- authenticity - the property that an entity is what it claims to be.
- residual cybersecurity risk - the cybersecurity risk left after risk treatment.
- security objective / cybersecurity objective - the protection result that the standard seeks to achieve against cyber threats.
- remediation - a change that removes or mitigates a vulnerability.
Who uses EN 40000-1-1:2026?
EN 40000-1-1:2026 is used by anyone who writes, reads, reviews, or implements the other standards in the cybersecurity requirements for products with digital elements family. That includes standards developers, product security engineers, vulnerability management teams, quality and compliance staff, manufacturers, suppliers, and buyers.
It is especially useful in IT security and product assurance work where people need to discuss advisories, remediation, residual risk, and security objectives without ambiguity.
Which standards are used with EN 40000-1-1:2026?
Clause 2 gives no normative references. The bibliography names these standards as sources for several definitions:
- ISO/IEC/IEEE 12207:2017 - source for the term activity.
- ISO/IEC 29147:2018 - source for advisory, remediation, and reporter.
- ISO/IEC 27035-3:2020 - source for asset.
- ISO/IEC 27000:2018 - source for authenticity, availability, confidentiality, integrity, and residual cybersecurity risk.
- ISO 28001:2007 - source for likelihood.
What does the EN 40000-1-1:2026 document contain?
EN 40000-1-1:2026 is a compact vocabulary document. Its main body is Clause 3, which contains 16 defined terms, several with source notes that identify where the wording comes from or where it was adapted.
The document also includes a foreword, an introduction that explains why a common language matters, a scope clause, a normative references clause, and a bibliography of five source standards. Its content is meant to support drafting, interpretation, review, and consistent use of the wider family of cybersecurity requirements.
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
Bureau Veritas
Bureau Veritas is a world leader in laboratory testing, inspection and certification services.
DNV
DNV is an independent assurance and risk management provider.
Sponsored listings
Frequently Asked Questions
EN 40000-1-1:2026 is a draft published by the European Committee for Standardization (CEN). Its full title is "Cybersecurity requirements for products with digital elements - Part 1-1: Vocabulary". This standard covers: This document provides the terms and definitions commonly used in the cybersecurity requirements for products with digital elements family of standards.
This document provides the terms and definitions commonly used in the cybersecurity requirements for products with digital elements family of standards.
EN 40000-1-1:2026 is classified under the following ICS (International Classification for Standards) categories: 01.040.35 - Information technology (Vocabularies); 35.030 - IT Security. The ICS classification helps identify the subject area and facilitates finding related standards.
EN 40000-1-1:2026 is associated with the following European legislation: EU Directives/Regulations: 2024/2847; Standardization Mandates: M/606. When a standard is cited in the Official Journal of the European Union, products manufactured in conformity with it benefit from a presumption of conformity with the essential requirements of the corresponding EU directive or regulation.
EN 40000-1-1:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
oSIST prEN 40000-1-1:2025
01-december-2025
Zahteve za kibernetsko varnost za izdelke z digitalnimi elementi - Slovar
Cybersecurity requirements for products with digital elements - Vocabulary
Ta slovenski standard je istoveten z: prEN 40000-1-1
ICS:
01.040.35 Informacijska tehnologija. Information technology
(Slovarji) (Vocabularies)
35.030 Informacijska varnost IT Security
oSIST prEN 40000-1-1:2025 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
oSIST prEN 40000-1-1:2025
oSIST prEN 40000-1-1:2025
EUROPEAN STANDARD DRAFT
prEN 40000-1-1
NORME EUROPÉENNE
EUROPÄISCHE NORM
October 2025
ICS 01.040.35; 35.030
English version
Cybersecurity requirements for products with digital
elements - Vocabulary
This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee
CEN/CLC/JTC 13.
If this draft becomes a European Standard, CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal
Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any
alteration.
This draft European Standard was established by CEN and CENELEC in three official versions (English, French, German). A
version in any other language made by translation under the responsibility of a CEN and CENELEC member into its own language
and notified to the CEN-CENELEC Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.Recipients of this draft are invited to submit, with their comments, notification
of any relevant patent rights of which they are aware and to provide supporting documentation.
Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without
notice and shall not be referred to as a European Standard.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2025 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. prEN 40000-1-1:2025 E
reserved worldwide for CEN national Members and for
CENELEC Members.
oSIST prEN 40000-1-1:2025
prEN 40000-1-1 (E)
Contents Page
European foreword . 3
Introduction . 4
1 Scope . 5
2 Normative references . 5
3 Terms and definitions . 5
Bibliography . 8
oSIST prEN 40000-1-1:2025
prEN 40000-1-1 (E)
European foreword
This document (prEN 40000-1-1:2025) has been prepared by Technical Committee CEN/CLC/JTC 13
"Cybersecurity and Data Protection", the secretariat of which is held by DIN.
This document is currently submitted to the CEN Enquiry.
This document has been prepared under a standardization request addressed to CEN by the European
Commission. The Standing Committee of the EFTA States subsequently approves these requests for its
Member States.
oSIST prEN 40000-1-1:2025
prEN 40000-1-1 (E)
Introduction
The effective implementation of cybersecurity requirements for products with digital elements relies
on a clear an
...