prEN 40000-1-2
(Main)Cybersecurity requirements for products with digital elements - Part 1-2: Principles for cyber resilience
Cybersecurity requirements for products with digital elements - Part 1-2: Principles for cyber resilience
This document specifies general cybersecurity principles and general risk management activities for all products with digital elements, hereafter also referred to as 'products'. This document covers every stage of the product lifecycle to ensure and maintain an appropriate level of cybersecurity based on the risks.
This document also provides generic elements to support the development of coherent product-category-specific standards (vertical standards).
This document:
— establishes generic cybersecurity principles applicable to all stages of the product lifecycle;
— specifies requirements for risk assessment and treatment of cybersecurity risks;
— specifies requirements on activities that can be applied to ensure an appropriate level of cybersecurity at every phase of the product lifecycle;
— provides elements and considerations for product category specific standards in order to facilitate a harmonized approach.
This document does not provide vertical product category specific activities and elements.
Cybersicherheitsanforderungen für Produkte mit digitalen Elementen - Grundsätze für die Cyberresilienz
Exigences de cybersécurité pour les produits comportant des éléments numériques - Partie 1-2 : Principes de cyberrésilience
Zahteve za kibernetsko varnost za izdelke z digitalnimi elementi - 1-2 del: Načela kibernetske odpornosti
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
01-december-2025
Zahteve za kibernetsko varnost za izdelke z digitalnimi elementi - 1-2 del: Načela
kibernetske odpornosti
Cybersecurity requirements for products with digital elements - Part 1-2: Principles for
cyber resilience
Cybersicherheitsanforderungen für Produkte mit digitalen Elementen - Grundsätze für
die Cyberresilienz
Ta slovenski standard je istoveten z: prEN 40000-1-2
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD DRAFT
NORME EUROPÉENNE
EUROPÄISCHE NORM
October 2025
ICS 35.030
English version
Cybersecurity requirements for products with digital
elements - Part 1-2: Principles for cyber resilience
Anforderungen an die Cybersicherheit von Produkten
mit digitalen Bestandteilen - Grundsätze für die
Cyberesilienz
This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee
CEN/CLC/JTC 13.
If this draft becomes a European Standard, CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal
Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any
alteration.
This draft European Standard was established by CEN and CENELEC in three official versions (English, French, German). A
version in any other language made by translation under the responsibility of a CEN and CENELEC member into its own language
and notified to the CEN-CENELEC Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.Recipients of this draft are invited to submit, with their comments, notification
of any relevant patent rights of which they are aware and to provide supporting documentation.
Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without
notice and shall not be referred to as a European Standard.
Contents Page
European foreword . 5
1 Scope . 6
2 Normative references . 6
3 Terms and definitions . 6
4 Introduction . 6
5 Cybersecurity principles . 7
5.1 General . 7
5.2 Risk-based approach to cybersecurity . 7
5.2.1 Principle . 7
5.2.2 Guidance . 7
5.3 Security by design . 8
5.3.1 Principle . 8
5.3.2 Guidance . 8
5.4 Secure by default . 9
5.4.1 Principle . 9
5.4.2 Guidance . 9
5.5 Transparency . 9
5.5.1 Principle . 9
5.5.2 Guidance . 9
6 Risk management elements . 10
6.1 General . 10
6.2 Product context . 12
6.2.1 General . 12
6.2.2 Input . 13
6.2.3 Requirement . 14
6.2.4 Output . 14
6.2.5 Assessment criteria . 14
6.3 Risk acceptance criteria and risk management methodology . 14
6.3.1 General . 14
6.3.2 Input . 16
6.3.3 Requirement . 16
6.3.4 Output . 16
6.3.5 Assessment criteria . 16
6.4 Risk assessment . 17
6.4.1 General . 17
6.4.2 Asset and cybersecurity objective identification . 17
6.4.3 Threat identification . 18
6.4.4 Risk estimation . 19
6.4.5 Risk evaluation . 20
6.5 Risk treatment . 21
6.5.1 General . 21
6.5.2 Input . 22
6.5.3 Requirement . 22
6.5.4 Output . 22
6.5.5 Assessment criteria . 22
6.6 Risk communication . 23
6.6.1 General . 23
6.6.2 Input . 23
6.6.3 Requirement . 23
6.6.4 Output . 24
6.6.5 Assessment criteria . 24
6.7 Risk monitoring and review . 24
6.7.1 General . 24
6.7.2 Input . 24
6.7.3 Requirement . 24
6.7.4 Output . 25
6.7.5 Assessment criteria . 25
7 Cybersecurity activities . 25
7.1 General . 25
7.2 Product cybersecurity planning . 26
7.2.1 General . 26
7.2.2 Input . 26
7.2.3 Requirement . 26
7.2.4 Output . 26
7.2.5 Assessment criteria . 26
7.3 Product cybersecurity requirements . 26
7.3.1 General . 26
7.3.2 Input . 27
7.3.3 Requirement . 27
7.3.4 Output . 28
7.3.5 Assessment criteria . 28
7.4 Cybersecurity architecture and design . 28
7.4.1 General . 28
7.4.2 Input .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.