The product-level requirements every product with digital elements must meet when placed on the market, applied on the basis of the manufacturer's cybersecurity risk assessment: one page for the risk assessment and one for each of points (2)(a) to (m).
The documented cybersecurity risk assessment that drives every Annex I decision: what it must analyze, how it records which point (2) requirements apply and why, how it is kept current through the support period, and how products designed before December 2027 are treated.
The requirement to place products on the market without known exploitable vulnerabilities: what makes a vulnerability exploitable and known, how pre-release scanning and component analysis support the decision, and how the risk-based release decision is documented.
Shipping products with a secure by default configuration and a way to reset them to their original state, the tailor-made product exception agreed with business users, and how the requirement applies to components delivered to integrators.
Ensuring vulnerabilities can be fixed through security updates, with automatic security updates on by default where applicable, a clear opt-out, update notifications and the option to postpone, and the products for which automatic updates are not expected.
Appropriate control mechanisms against unauthorized access to the product, such as authentication and identity or access management, and the product's ability to report possible unauthorized access.
Protecting the confidentiality of stored, transmitted or otherwise processed data, personal or other, for example by encrypting relevant data at rest and in transit with state of the art mechanisms.
Protecting the integrity of stored, transmitted or processed data, commands, programs and configuration against manipulation or modification the user has not authorized, and reporting on corruptions.
Processing only data, personal or other, that is adequate, relevant and limited to what the product's intended purpose needs, and recording that choice in the risk assessment and technical documentation.
Protecting the availability of the product's essential and basic functions, including after an incident, through resilience and mitigation measures against denial-of-service attacks.
Minimizing the negative impact that the product itself or connected devices have on the availability of services provided by other devices or networks.
Designing, developing and producing products to limit attack surfaces, including external interfaces: removing or disabling what the product does not need and documenting the exposure that remains.
Reducing the impact of an incident through appropriate exploitation mitigation mechanisms and techniques, such as isolating critical components, chosen according to the risk assessment.
Providing security-related information by recording and monitoring relevant internal activity, including access to or modification of data, services or functions, with an opt-out mechanism for the user.
Letting users securely and easily remove all data and settings permanently, and making sure any transfer of data to other products or systems is done securely.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.