EN 40000: The Horizontal Standards for the CRA
This article describes the status as of October 2025, when the first EN 40000 drafts were released for comment. For the current status, see our pages on the EN 40000 series and on harmonized standards for the CRA.
The first horizontal drafts of the EN 40000 series are available from October 24, 2025. This is a milestone for implementing the Cyber Resilience Act (CRA). The two drafts, prEN 40000-1-1 (Vocabulary) and prEN 40000-1-2 (Principles for Cyber Resilience), form the framework on which all further product-specific standards build.
Contents
Horizontal before vertical: the foundation for all product categories
ETSI has already published draft standards for specific product categories such as password managers, routers, and operating systems. What was missing so far was a basis that applies across all products. The horizontal drafts from CEN and CENELEC now close this gap.
The two levels differ as follows:
- Horizontal standards (EN 40000) apply to all products with digital elements, regardless of category.
- Vertical standards (ETSI EN 304 6xx) specify the horizontal requirements for particular product categories.
Manufacturers will need both levels to cover the CRA requirements for their product. A presumption of conformity applies to the requirements that a standard covers, once its reference is published in the Official Journal (Article 27(1) of the CRA).
prEN 40000-1-1: Vocabulary
The vocabulary draft sets the common terminology for the whole family of standards. It defines central terms such as acceptable risk, residual risk, product control, and security objective. Shared terms are a precondition for consistent conformity assessment across all product categories.
prEN 40000-1-2: Principles for cyber resilience
This draft is the technical core of the series. It defines four fundamental principles:
- risk-based approach
- security by design
- secure by default
- transparency
The draft puts these principles into practice in two ways:
- Six risk management elements: product context, risk acceptance criteria, risk assessment, risk treatment, risk communication, and risk monitoring.
- Ten cybersecurity activities across the entire product lifecycle: planning, requirements, architecture and design, secure implementation, verification and validation, secure production and distribution, issue management, product monitoring, planning for secure decommissioning, and third-party component management.
Each activity is structured into input, requirement, output, and assessment criteria. The structure does not prescribe a particular process, so you can apply it with different development methods.
How the vertical standards fit in
The ETSI standards for specific product categories build on this framework:
- Use cases specify the definition of the product context.
- Threat models follow the risk assessment framework.
- Product-specific mitigations implement the required controls.
- Assessment criteria add to the horizontal requirements.
Annex A of prEN 40000-1-2 gives vertical standards explicit guidance on how to stay consistent with the horizontal framework.
Status and next steps
The drafts are in the CEN enquiry, in which stakeholders can submit comments. Once finalized, the standards are to be cited in the Official Journal of the EU.
Further work is under way in parallel:
- generic security requirements (a horizontal catalog of controls)
- vulnerability handling requirements (horizontal)
- further vertical standards from ETSI and other standardization organizations
What manufacturers should do now
For manufacturers, this is the right time to:
- Study the horizontal drafts and submit comments.
- Implement a risk management framework based on EN 40000-1-2.
- Prepare for the final vertical standards for your product category.
If you implement the horizontal requirements now, you are well placed once the final product-specific standards are available.
Availability
The drafts are available from the national standards bodies that are members of CEN and CENELEC:
- prEN 40000-1-1: Vocabulary
- prEN 40000-1-2: Principles for Cyber Resilience
Our guide on where to buy ISO, IEC, and EN standards explains how to obtain standards. For more on the vertical ETSI drafts, see our article on the ETSI draft standards for the CRA.
The EN 40000 standards set a uniform technical foundation for the Cyber Resilience Act for the first time. If you want to understand how strongly your products are affected and which next steps make sense, we can work this out together in a no-obligation call.
