EN 40000 Harmonized Standards for the Cyber Resilience Act

The Cyber Resilience Act sets essential cybersecurity requirements for products with digital elements, but it does not say how a manufacturer should meet them technically or in its processes. The EN 40000 series fills this gap. It is a family of horizontal standards that translates the requirements of Regulation (EU) 2024/2847 into traceable requirements, processes, and technical mechanisms. Its foundation is the vocabulary standard EN 40000-1-1, which defines the terms used across the series.

Contents

1. The EN 40000 series at a glance
2. Where EN 40000 fits in EU cybersecurity regulation
3. Standardization status: EN, prEN, and the route to the Official Journal
4. Structure of the EN 40000 series
   1. EN 40000-1-1 (Vocabulary)
   2. EN 40000-1-2 (Principles for Cyber Resilience)
   3. EN 40000-1-3 (Vulnerability Handling)
   4. EN 40000-1-4 (Generic Security Requirements)
   5. TR 40000-1-5 (Threats and Security Objectives)
5. Horizontal and vertical CRA standards work together
6. Contribution to the presumption of conformity
7. Relation to other standards
8. Availability
9. Outlook

The EN 40000 series at a glance

The EN 40000 series is a family of European standards on the cybersecurity of products with digital elements. It specifies the essential requirements of the Cyber Resilience Act without creating law itself. Its horizontal core has four parts: a common vocabulary, principles, vulnerability handling, and technical requirements. Vertical parts for individual product categories come on top.

The series is therefore not a separate set of rules. It is the layer of standards beneath the regulation that helps manufacturers implement their obligations under the Cyber Resilience Act in a structured way.

Where EN 40000 fits in EU cybersecurity regulation

Annex I of the Cyber Resilience Act (CRA) sets out the essential requirements. Part I covers the properties of the product, Part II the processes for vulnerability handling. The EN 40000 series structures and specifies these requirements. It turns abstract protection goals into concrete requirements and describes how you can demonstrate that you meet them.

For manufacturers of machinery, plants, and connected devices, this translation is the real benefit. Take a CNC controller with remote maintenance or an industrial IoT sensor with a radio link. If you place such a product on the market, EN 40000 connects the legal text with the technical implementation. For machinery, the cybersecurity requirements of the CRA also meet those of the Machinery Regulation.

Standardization status: EN, prEN, and the route to the Official Journal

A harmonized European standard goes through several stages. While it is a draft, it carries the prefix prEN and has no formal standing. Only after the vote, adoption, and publication does it become a ratified EN. The presumption of conformity with the CRA requires one more step: the standard must be cited as a harmonized standard in the Official Journal of the European Union.

As of October 2026, all parts of the EN 40000 series are still drafts, and none is cited in the Official Journal. The first parts are in the final vote. The European Commission's page on CRA standardization gives the current status. For an analysis of the first available drafts, see our article EN 40000: The Horizontal Standards for the CRA.

Structure of the EN 40000 series

The series follows a clear logic: common terms, overarching principles, a vulnerability handling process, and a catalog of technical requirements. An informative technical report provides the underlying system of threats and security objectives.

EN 40000-1-1 (Vocabulary)

The vocabulary standard EN 40000-1-1 is the terminological foundation of the whole series. It defines the central terms that the other parts refer to and so ensures that they are understood the same way across the family. It contains no normative requirements of its own.

Most of the terms come directly from Regulation (EU) 2024/2847. The standard takes several core definitions word for word from Article 3 of the CRA. They include product with digital elements, vulnerability, software bill of materials (SBOM), and remote data processing solutions. The standards committee adds further terms from established ISO/IEC sources, such as coordination, remediation, and embargo period, so that the vulnerability handling process can be described precisely.

This part is further advanced than most others. As of October 2026, it is one of the first parts in the final vote.

EN 40000-1-2 (Principles for Cyber Resilience)

The principles standard EN 40000-1-2 describes four overarching principles for the cyber resilience of products: a risk-based approach, security by design, secure by default, and transparency. Risk management and technical measures are aligned with these principles.

Beyond the principles, the standard sets a framework for the entire product lifecycle. First, it describes the elements of risk management: establish the product context, set risk acceptance criteria, assess risks, treat them, communicate them, and monitor and review them. Second, it names the cybersecurity activities along the lifecycle, from planning, architecture, and secure implementation to secure production, product monitoring, and secure decommissioning.

An informative mapping annex assigns these requirements to the essential requirements of the CRA. The mapping covers Annex I, Part I of Regulation (EU) 2024/2847, both point 1 and point 2. The principles standard therefore reaches further than a reference to a single requirement would suggest.

EN 40000-1-3 (Vulnerability Handling)

The vulnerability handling standard EN 40000-1-3 structures how you deal with vulnerabilities across the entire product lifecycle. It arranges the activities in six consecutive phases:

1. Preparation
2. Receipt of reports
3. Verification
4. Remediation
5. Release
6. Post-release activities

In the preparation phase, the manufacturer sets up its internal vulnerability handling policy, its coordinated vulnerability disclosure policy, and the software bill of materials (SBOM), among other things. In the following phases, reports are received, assessed, and remediated, and fixes are distributed through secure update mechanisms.

The SBOM plays a central role. It makes the components of a product traceable and lets you match incoming vulnerability information against your own product.

The standard builds on the established international standards ISO/IEC 29147 and ISO/IEC 30111 for vulnerability disclosure and vulnerability handling processes. Unlike them, it does not stop at recommendations. It sets normative requirements that cover the obligations of the CRA. A mapping annex assigns the requirements to the essential requirements in Annex I, Part II of the CRA.

EN 40000-1-4 (Generic Security Requirements)

EN 40000-1-4 is the central standard of the series for technical product security. It covers the technical requirements of Annex I, Part I of the CRA and is divided into 13 requirement areas. They include vulnerability assessment, secure configuration, security updates, access control, protection of confidentiality and integrity, data minimization, availability, attack surface reduction, logging and monitoring, and secure deletion of data.

For each requirement area, the standard provides a library of technical mechanisms. It ranges from access control and authentication mechanisms through secure update and storage mechanisms, secure communication, logging, and deletion to mechanisms for confidential cryptographic keys and for cryptography in general. On cryptography, the draft stresses crypto agility: the ability to replace cryptographic methods when the state of the art changes.

The technical link of this standard leads to the Radio Equipment Directive (RED), more precisely to EN 18031. EN 40000-1-4 assigns the identifiers of all its technical requirements according to the scheme of the EN 18031 series. It has, however, revised the requirements it took over and adapted them to the CRA. It also has areas with no counterpart in EN 18031, such as data minimization, monitoring of security-relevant activities, and protection of processed data. The mapping between the two standards is in an informative annex. EN 40000-1-4 does not list EN 18031 as a normative reference. If you already apply EN 18031, you will find part of the requirements again and can reuse your groundwork. That alone does not meet any requirement of EN 40000-1-4.

EN 40000-1-4 is still a draft and has not been adopted. Its structure and individual requirements may still change. This description reflects the current draft.

TR 40000-1-5 (Threats and Security Objectives)

TR 40000-1-5 is a technical report and therefore informative. It is not a normative standard and cannot be harmonized. It does not trigger a presumption of conformity and contains no mandatory requirements.

The report sets out a system of threats and security objectives for products with digital elements. It derives them from the essential requirements of the CRA, specifically from Annex I, Part I, point 2. The report is explicitly meant as the basis for the horizontal requirements standard EN 40000-1-4. It provides the system of threats and security objectives on which the technical mechanisms build.

The report is at an early draft stage and still has placeholders on its title page. Treat its content as orientation, not as an agreed position.

Horizontal and vertical CRA standards work together

The horizontal parts of EN 40000 are only one part of a larger set of CRA standards, which are divided into horizontal and vertical standards. The horizontal standards apply across all product groups. They include EN 40000-1-1 to -1-4 and the supplementary technical report TR 40000-1-5. Together they form the common basis for all products with digital elements.

The vertical standards specify the requirements for particular product categories. Several standardization groups work on them, each with its own numbering. Even within EN 40000, there are vertical, product-specific parts alongside the horizontal ones. So far, EN 40000-10 and EN 40000-11 are known, and more are likely to follow. Other groups develop further vertical EN families, such as the ETSI series EN 304 6xx, the EN 50770-x series, and EN 50764 to EN 50767. A large number of vertical standardization projects are now under way:

Level	Standard series	Scope
Horizontal	EN 40000-1-1 to -1-4, TR 40000-1-5	Common basis for all products
Vertical	EN 40000-10, EN 40000-11	Identity and access management; hardware devices with security boxes
Vertical	ETSI EN 304 6xx	IT and consumer products, such as browsers, password managers, VPNs, operating systems, smart home products
Vertical	EN 50770-x series	Operational technology (OT), based on IEC 62443
Vertical	EN 50764 to EN 50767	Hardware security, such as microprocessors and microcontrollers with security functions

EN 40000-10 addresses products for identity and access management: identity management systems, privileged access management software and hardware, and authentication and access control readers, including biometric readers. It is tailored to important products and refers normatively to EN 40000-1-3 for vulnerability handling. EN 40000-11 addresses hardware devices with security boxes, that is, devices with a physically protected enclosure that provide secure storage and cryptographic operations in an open environment. Its scope is also tailored to important products. Both standards are drafts and are not yet cited in the Official Journal.

The ETSI series EN 304 6xx covers IT and consumer products and follows in the tradition of the established consumer IoT standard ETSI EN 303 645. For operational technology, the EN 50770 series draws on IEC 62443, which is already widely used in industry. These OT standards also rely on familiar parts of the 62443 family, such as IEC 62443-4-1 for the secure development process and IEC 62443-4-2 for technical component requirements.

Contribution to the presumption of conformity

A harmonized standard can trigger a presumption of conformity. If you apply it in full, you may presume that the essential requirements it covers are met. This effect has one condition: it arises only once the standard is cited as a harmonized standard in the Official Journal of the European Union.

So far, none of the EN 40000 standards triggers a presumption of conformity, because none is cited in the Official Journal. Until that happens, treat the standards as guidance and as a reference for the state of the art. Applying them consistently already helps you meet the CRA requirements in a structured way. Whether and when the individual parts will be cited, and so give a formal presumption of conformity, is not yet settled. This does not apply to the technical report TR 40000-1-5 in any case: as an informative document, it cannot confer a presumption of conformity.

Relation to other standards

The EN 40000 series does not stand alone. It refers to established standards and builds on them.

The closest technical link is to EN 18031, the standard series for the Radio Equipment Directive (RED). EN 40000-1-4 adopts its identifier scheme and maps the two standards to each other in an informative annex, but it does not list EN 18031 as a normative reference. The mapping shows which groundwork from the RED carries over. It does not establish conformity with EN 40000-1-4.

For vulnerability handling, the series refers to the international process standards ISO/IEC 29147 and ISO/IEC 30111. EN 40000-1-3 refines their provisions and turns recommendations into normative requirements.

For secure product development, there are links to IEC 62443-4-1, the established process standard in industry. Content also overlaps with ISO/IEC 27001 for information security management systems and with the vertical ETSI standards. Unlike these, the EN 40000 series is explicitly tailored to product regulation under the CRA.

For machinery, EN 50742 adds a further link to IEC 62443: its approach B uses the 62443 family as a way to demonstrate compliance. This connects the established body of industrial standards with the cybersecurity requirements for machinery.

Availability

The drafts are available from the national standards bodies that are members of CEN and CENELEC, for example AFNOR in France, BSI in the United Kingdom, DIN in Germany, and UNI in Italy. Our guide on where to buy ISO, IEC, and EN standards explains how to obtain standards. The European Commission's page on CRA standardization tracks the progress of all CRA standardization projects.

Outlook

The EN 40000 series is becoming the standards backbone of the Cyber Resilience Act. The vocabulary standard provides the foundation and the principles standard the lifecycle framework. The vulnerability handling standard provides the process, and the requirements standard the technical mechanisms, including the link to EN 18031. Vertical parts for individual product categories are being added, such as EN 40000-10 for identity and access management and EN 40000-11 for hardware devices with security boxes. All of these parts are still drafts and are not cited in the Official Journal. They therefore do not yet trigger a formal presumption of conformity. Until then, the series is a useful frame of reference for interpreting the CRA requirements.

Manufacturers should follow the development early. If you align your products and processes with the EN 40000 logic now, you shorten the route to conformity later. For how the EN 40000 series fits with other standards, see the overview of cybersecurity standards.