Note on this version

The current version of this report was prepared following a public consultation held by ENISA during April 2026 and May 2026. ENISA received 28 contributions from public and private stakeholders, cybersecurity experts, product manufacturers, software development practitioners and the open-source community. We would like to publicly thank all stakeholders who provided their views and feedback. All contributions have been reviewed and, to the maximum extent possible, the recommendations and observations have been addressed in this final version. This report may undergo regular revisions.

Acknowledgements

ENISA would like to acknowledge the following individuals and organisations that contributed to the public consultation and agreed to be publicly named.

Name Affiliation

Adam Shostack OWASP Foundation Anthony Harrison APH10 Arne Padmos Biserka Radeva Ministry of Electronic Governance Bob Lord Software Safety Institute Brunn Hilmar Mettler-Toledo International Cédric LEVY-BENCHETON cetome Dave Russo Red Hat LLC Diana Rossi Dr. Thomas Termin WITTE Automotive / Institute for Security Systems Friedhelm Becker Ioana Nilwik J B Toby Avolites Ltd Joan Romero Chaparro craevidence.com Johan Sydseter OWASP Foundation Juan Rico Eclipse Foundation Jukka Ruohonen University of Southern Denmark Kenichi Ikegami JTEKT ELECTRONICS Corporation Lauren Zabierek Software Safety Institute Madalin Neag OpenSSF/The Linux Foundation Martin Schneider Fraunhofer FOKUS Martin Zimpel BSI Matthew Coles OWASP Foundation Max Alejandro Gómez Sánchez Vergaray OWASP Foundation Michael Schuster BSI Nikos Mavrogiannopoulos ASSA ABLOY Patrick Lamplmair Tributech Philippe BOINOT ANSSI Sanjay Kumar Sirurmath Sarah Fluchs admeritia Sebastien Deleersnyder OWASP Foundation Sebastien Deleersnyder OWASP Foundation Thierry Dupont Zoe Braiterman OWASP Foundation

1. Pregled

1.1 Reference

1.2 Utvrđeni zahtjevi

1.3 Povezani propisi

2. Utvrđeni zahtjevi

3. Povezani propisi

• ENISA -