oSIST prEN 40000-1-1:2025
(Main)Cybersecurity requirements for products with digital elements - Vocabulary
Cybersecurity requirements for products with digital elements - Vocabulary
This document provides the terms and definitions commonly used in the cybersecurity requirements for products with digital elements family of standards.
Exigences de cybersécurité pour les produits comportant des éléments numériques - Vocabulaire
Zahteve za kibernetsko varnost za izdelke z digitalnimi elementi - Slovar
General Information
- Status
- Not Published
- Public Enquiry End Date
- 30-Dec-2025
- Technical Committee
- ITC - Information technology
- Current Stage
- 4020 - Public enquire (PE) (Adopted Project)
- Start Date
- 16-Oct-2025
- Due Date
- 05-Mar-2026
- Completion Date
- 22-Dec-2025
Overview
prEN 40000-1-1 is the draft CEN/CENELEC vocabulary for the "Cybersecurity requirements for products with digital elements" family of standards. Prepared by Technical Committee CEN/CLC/JTC 13 (secretariat: DIN) and submitted for CEN enquiry (October 2025), this document establishes a common language to ensure alignment across standards, regulation and industry practice. It references Regulation (EU) 2024/2847 and relevant ISO/IEC sources.
Why it matters: a unified vocabulary reduces ambiguity, improves compliance with EU requirements, and supports consistent risk management, incident handling, and product security lifecycle activities.
Key Topics
This vocabulary sets out clear terms and definitions commonly used across the prEN 40000 series. Key entries include:
- acceptable risk - the level of risk deemed acceptable for intended and reasonably foreseeable use, considering state of the art and safety.
- activity - a set of cohesive tasks.
- advisory - vulnerability information intended to reduce risk (how to identify/remediate vulnerabilities).
- asset - anything of value to an individual, organization, or government.
- authenticity, availability, confidentiality, integrity - core information security properties.
- likelihood - ease or difficulty for a threat scenario to progress to an incident.
- online hosting location - infrastructure storing/serving website, application, or online service resources.
- product control - a measure on a product that modifies risk.
- remediation - changes made to remove or mitigate vulnerabilities (patch, fix, update).
- reporter - individual or organization notifying a vendor/coordinator of a potential vulnerability.
- residual cybersecurity risk - risk remaining after treatment.
- security objective - result to be achieved regarding protection from cyber threats.
- software package - bundled collection of software and data.
These definitions reference ISO/IEC terminology resources (ISO OBP, IEC Electropedia) and established standards such as ISO/IEC 27000 and ISO/IEC 29147.
Applications
This vocabulary is intended for:
- Standards writers aligning requirements across product categories with digital elements.
- Manufacturers and vendors implementing cybersecurity requirements and documenting risk treatments.
- Security teams handling vulnerability disclosure, remediation, and incident response.
- Regulators and conformity assessors verifying compliance with EU rules and prEN 40000 series.
Practical benefits include clearer procurement specifications, consistent reporting, and improved interoperability of security controls.
Related Standards
- Regulation (EU) 2024/2847 (referenced in the vocabulary)
- ISO/IEC 27000 series (information security vocabulary)
- ISO/IEC 29147 (vulnerability disclosure)
- ISO/IEC/IEEE 12207 (software life cycle processes)
For implementation, consult the full prEN 40000 series and referenced ISO/IEC resources to ensure consistent interpretation and application of terms.
Frequently Asked Questions
oSIST prEN 40000-1-1:2025 is a draft published by the Slovenian Institute for Standardization (SIST). Its full title is "Cybersecurity requirements for products with digital elements - Vocabulary". This standard covers: This document provides the terms and definitions commonly used in the cybersecurity requirements for products with digital elements family of standards.
This document provides the terms and definitions commonly used in the cybersecurity requirements for products with digital elements family of standards.
oSIST prEN 40000-1-1:2025 is classified under the following ICS (International Classification for Standards) categories: 01.040.35 - Information technology (Vocabularies); 35.030 - IT Security. The ICS classification helps identify the subject area and facilitates finding related standards.
oSIST prEN 40000-1-1:2025 is associated with the following European legislation: Standardization Mandates: M/606. When a standard is cited in the Official Journal of the European Union, products manufactured in conformity with it benefit from a presumption of conformity with the essential requirements of the corresponding EU directive or regulation.
oSIST prEN 40000-1-1:2025 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-december-2025
Zahteve za kibernetsko varnost za izdelke z digitalnimi elementi - Slovar
Cybersecurity requirements for products with digital elements - Vocabulary
Ta slovenski standard je istoveten z: prEN 40000-1-1
ICS:
01.040.35 Informacijska tehnologija. Information technology
(Slovarji) (Vocabularies)
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD DRAFT
NORME EUROPÉENNE
EUROPÄISCHE NORM
October 2025
ICS 01.040.35; 35.030
English version
Cybersecurity requirements for products with digital
elements - Vocabulary
This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee
CEN/CLC/JTC 13.
If this draft becomes a European Standard, CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal
Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any
alteration.
This draft European Standard was established by CEN and CENELEC in three official versions (English, French, German). A
version in any other language made by translation under the responsibility of a CEN and CENELEC member into its own language
and notified to the CEN-CENELEC Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.Recipients of this draft are invited to submit, with their comments, notification
of any relevant patent rights of which they are aware and to provide supporting documentation.
Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without
notice and shall not be referred to as a European Standard.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2025 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. prEN 40000-1-1:2025 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3
Introduction . 4
1 Scope . 5
2 Normative references . 5
3 Terms and definitions . 5
Bibliography . 8
European foreword
This document (prEN 40000-1-1:2025) has been prepared by Technical Committee CEN/CLC/JTC 13
"Cybersecurity and Data Protection", the secretariat of which is held by DIN.
This document is currently submitted to the CEN Enquiry.
This document has been prepared under a standardization request addressed to CEN by the European
Commission. The Standing Committee of the EFTA States subsequently approves these requests for its
Member States.
Introduction
The effective implementation of cybersecurity requirements for products with digital elements relies
on a clear an
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.
Loading comments...