+ANNEX I ESSENTIAL CYBERSECURITY REQUIREMENTS
---+Part I Cybersecurity requirements relating to the properties of products with digital elements
------+(1) Products with digital elements shall be designed, developed and produced in such a way that …
------+(2) On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where …
---------+(a) be made available on the market without known exploitable vulnerabilities;
---------+(b) be made available on the market with a secure by default configuration, unless otherwise agreed …
---------+(c) ensure that vulnerabilities can be addressed through security updates, including, where …
---------+(d) ensure protection from unauthorised access by appropriate control mechanisms, including but not …
---------+(e) protect the confidentiality of stored, transmitted or otherwise processed data, personal or …
---------+(f) protect the integrity of stored, transmitted or otherwise processed data, personal or other …
---------+(g) process only data, personal or other, that are adequate, relevant and limited to what is …
---------+(h) protect the availability of essential and basic functions, also after an incident, including …
---------+(i) minimise the negative impact by the products themselves or connected devices on the …
---------+(j) be designed, developed and produced to limit attack surfaces, including external interfaces;
---------+(k) be designed, developed and produced to reduce the impact of an incident using appropriate …
---------+(l) provide security related information by recording and monitoring relevant internal activity …
---------+(m) provide the possibility for users to securely and easily remove on a permanent basis all data …
---+Part II Vulnerability handling requirements
------+(1) identify and document vulnerabilities and components contained in products with digital …
------+(2) in relation to the risks posed to products with digital elements, address and remediate …
------+(3) apply effective and regular tests and reviews of the security of the product with digital …
------+(4) once a security update has been made available, share and publicly disclose information about …
------+(5) put in place and enforce a policy on coordinated vulnerability disclosure;
------+(6) take measures to facilitate the sharing of information about potential vulnerabilities in their …
------+(7) provide for mechanisms to securely distribute updates for products with digital elements to …
------+(8) ensure that, where security updates are available to address identified security issues, they …
|
ANNEX I ESSENTIAL CYBERSECURITY REQUIREMENTS
ANNEX I ESSENTIAL CYBERSECURITY REQUIREMENTS
1. Overview
1.1 References
1.2 Identified Requirements
1.3 Related Standards
2. Identified Requirements
Requirements
| Source |
Requirement |
3. Related Standards
Standards
| Source |
Requirement |
Linked Issues
- Builddate: 20.11.2024 00:00:00 -Doknr: CELEX:32024R2847
- EULAW -
EN: Legal acts of the European Union from EUR-Lex, https://eur-lex.europa.eu/. © European Union. Re-use is authorised by Decision 2011/833/EU, provided the source is acknowledged; the consolidated texts are licensed under CC BY 4.0 (EUR-Lex legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the legislation published in the Official Journal of the European Union is deemed authentic.
DE: Rechtsakte der Europäischen Union aus EUR-Lex, https://eur-lex.europa.eu/. © Europäische Union. Weiterverwendung nach Beschluss 2011/833/EU mit Quellenangabe gestattet; die konsolidierten Fassungen stehen unter CC BY 4.0 (Rechtlicher Hinweis von EUR-Lex). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Verbindlich sind allein die im Amtsblatt der Europäischen Union veröffentlichten Rechtsakte.
|