Transatlantic Technology Research, home

Research & analysis for U.S. companies in European markets

NewsletterSaved

Glossary: EU Product Security and Embedded Terms

Plain-language definitions of the regulatory and engineering terms used on this site, each pointing to the page that covers it in depth.

By the editorial teamLast updated Written with the help of AI tools

Short, plain definitions of terms used across this site. Legal terms are paraphrased from the regulation that defines them; check the cited text for the exact wording. Each entry links to the page that covers the topic in depth.

A · B · C · D · E · H · I · M · N · O · P · R · S · T · V · Y

A

A/B update. An update scheme where the device keeps two copies (slots) of its firmware or system image. The update is written to the inactive slot while the active one keeps running, the device switches to the new slot, and it can fall back to the old one if the new image fails checks or doesn’t boot. MCUboot, for example, documents primary and secondary image slots with swap and revert [1], and RAUC documents symmetric A/B root filesystem slots [34]. → Secure firmware update architecture

Actively exploited vulnerability. Under the Cyber Resilience Act, a vulnerability where there’s reliable evidence that a malicious actor has exploited it in a system without the system owner’s permission [2]. Since 11 September 2026, manufacturers must report these within tight deadlines [2]. → How to set up a PSIRT; Cyber Resilience Act reporting workflow

Anti-rollback. Protection that stops a device from accepting an older, validly signed firmware version that may contain known vulnerabilities. A common approach is a monotonically increasing sequence number in the update manifest, compared with a value the device stores [3], sometimes backed by a hardware security counter [1]. → Hardware root of trust and secure boot

B

BSP (board support package). The drivers, definitions and other components that make a software platform run on a specific hardware configuration [4]. → Embedded systems consulting

C

CE marking. The mark a manufacturer affixes to show that a product, and under the Cyber Resilience Act also the manufacturer’s processes, conform to the essential cybersecurity requirements and other applicable EU harmonisation law [2]. → Cyber Resilience Act guide; Cyber Resilience Act conformity assessment

Connected product. Under the EU Data Act, an item that obtains, generates or collects data about its use or environment, can communicate product data (over a network, a physical connection or on-device access), and whose primary function isn’t storing or processing data for someone other than the user [5]. The Commission’s examples include industrial machines, robots and agricultural machinery [6]. → EU Data Act guide

Coordinated vulnerability disclosure (CVD). A way of handling vulnerability reports in which the finder and the product’s maker coordinate on fixing and disclosing the issue. The Cyber Resilience Act requires manufacturers to put in place and enforce a CVD policy and to provide a contact address for vulnerability reports [2]. In the US, CISA runs a CVD program for vulnerabilities affecting critical infrastructure [7]. → Coordinated vulnerability disclosure guide

Critical product. A product with digital elements whose core functionality matches a category in Annex IV of the Cyber Resilience Act. The Commission may require these to obtain a European cybersecurity certificate at assurance level at least "substantial" through delegated acts [2]. → Cyber Resilience Act product classes

Cyber Resilience Act (CRA). Regulation (EU) 2024/2847, the EU law setting cybersecurity requirements for products with digital elements and duties for their manufacturers, importers and distributors [2]. It entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026, and the main obligations from 11 December 2027 [2][8]. → Cyber Resilience Act guide

CycloneDX. An open format for bills of materials, including SBOMs, maintained by the OWASP CycloneDX project [9] and standardised by Ecma International as ECMA-424 [10]. → SBOM generation for embedded products

D

Data holder. Under the EU Data Act, a person or company that has the right or obligation to use and make available data, including product or related service data it has retrieved or generated while providing a related service [5]. For connected products, this can be the manufacturer. → EU Data Act guide; connected equipment data API architecture

Device fleet management. The tools and processes used to manage devices once they’re deployed, such as inventory, configuration, monitoring and update rollout. → Device fleet management guide

E

EN 18031. A three-part European standard (EN 18031-1, -2 and -3:2024) with common security requirements for internet-connected radio equipment, covering network protection, personal data and privacy, and monetary-value functions. The Commission published its references in the Official Journal with restrictions in January 2025, under the RED cybersecurity delegated act [11]. → EN 18031 and the RED delegated act

ENISA Single Reporting Platform (SRP). The platform, set up and run by ENISA, through which manufacturers submit Cyber Resilience Act notifications of actively exploited vulnerabilities and severe incidents. Notifications go simultaneously to the CSIRT designated as coordinator and to ENISA [2][12]. → Cyber Resilience Act reporting obligations now apply; Cyber Resilience Act reporting workflow

ETSI EN 303 645. An ETSI European Standard setting baseline cybersecurity requirements for consumer Internet of Things products. The current version is V3.1.3, dated September 2024 [13]. → Product security standards; ETSI EN 303 645

EU Data Act. Regulation (EU) 2023/2854, which gives users of connected products and related services rights to access and share the data they generate, and sets rules for data holders [5]. It has applied since 12 September 2025, and its access-by-design duty covers products placed on the market after 12 September 2026 [5]. → EU Data Act guide

H

Hardware root of trust. The hardware-anchored component a device trusts unconditionally, from which it builds a chain of trust to verify everything that runs after it. NIST describes roots of trust as elements that must always behave as expected, because their misbehavior can’t be detected [14]. → Hardware root of trust and secure boot

Harmonised standard. A European standard adopted at the Commission’s request to support EU product law [15]. Under the Cyber Resilience Act, conforming to one whose reference is published in the Official Journal gives a presumption of conformity with the requirements it covers [2]. → Product security standards

HSM (hardware security module). A physical computing device that safeguards and manages cryptographic keys and performs cryptographic operations [16]. NIST’s code-signing guidance describes storing signing private keys in an HSM [33]. → Firmware signing and key management

I

IEC 62443. A series of international standards on security for industrial automation and control systems, from asset-owner programs to system and component requirements [17]. Product makers mostly use Part 4-1 (secure development lifecycle) and Part 4-2 (component technical requirements) [18][19]. → Product security standards; IEC 62443 certification

Important product. A product with digital elements whose core functionality matches a category in Annex III of the Cyber Resilience Act, split into class I and class II. These follow stricter conformity assessment routes. Integrating such a component doesn’t by itself make the host product important [2]. → Cyber Resilience Act product classes

M

Machinery Regulation. Regulation (EU) 2023/1230, the EU law on health and safety requirements for machinery and related products [20]. It includes requirements to protect safety-relevant software and data against corruption [20]. EUR-Lex lists its application date as 20 January 2027 [21]. → Machinery Regulation cybersecurity

N

Notified body. A conformity assessment body designated under EU law to carry out third-party conformity assessment [2]. Under the Cyber Resilience Act, notified bodies are involved for certain important products, and the chapter on notifying them has applied since 11 June 2026 [2]. → Cyber Resilience Act conformity assessment

O

OTA (over-the-air) update. Delivering firmware or software updates to a device over a network rather than by physical access. The IETF’s SUIT architecture describes how such updates can be secured for constrained IoT devices [22]. → Secure firmware update architecture

P

Product with digital elements. The Cyber Resilience Act’s term for a software or hardware product and its remote data processing solutions, including components placed on the market separately [2]. → Cyber Resilience Act guide

PSIRT (product security incident response team). The function inside a company that identifies, assesses and resolves vulnerabilities in the products it sells, as described by FIRST’s PSIRT Services Framework [23]. Not to be confused with a CSIRT, which handles incidents in an organization’s own systems or nationally. → How to set up a PSIRT

R

RED delegated act. Commission Delegated Regulation (EU) 2022/30, which activated cybersecurity, privacy and fraud-protection requirements of the Radio Equipment Directive for certain radio equipment. It has applied since 1 August 2025 and is repealed with effect from 11 December 2027 [24][25]. → EN 18031 and the RED delegated act

Related service. Under the EU Data Act, a digital service, including software, connected with a connected product so that without it the product couldn’t perform one of its functions, or added later to extend or adapt them [5]. The Commission’s example is an app that adjusts a light’s brightness [6]. → EU Data Act guide

S

SBOM (software bill of materials). A formal record of the components in a product’s software and their supply-chain relationships [2]. The Cyber Resilience Act requires one, in a commonly used, machine-readable format, covering at least top-level dependencies [2]. → SBOM generation for embedded products

Secure boot (embedded). A boot process in which each stage checks the next before running it, so the device only runs firmware it trusts. NIST SP 800-193 describes the concepts it rests on: a root of trust that anchors a chain of trust [14]. On this site, the term always means embedded devices, not PC firmware settings. → Hardware root of trust and secure boot

Secure element. A dedicated security chip used to store keys and perform cryptographic operations. GlobalPlatform publishes specifications that standardise secure element technology [26]. → Hardware root of trust and secure boot

SPDX. An open standard for communicating software bill of materials information, including provenance, license and security information, recognised internationally as ISO/IEC 5962:2021 [27]. → SBOM generation for embedded products

Support period. Under the Cyber Resilience Act, the time during which a manufacturer must handle a product’s vulnerabilities effectively [2]. It should reflect how long the product is expected to be in use, and it’s at least five years unless the product is expected to be in use for less [2]. → Cyber Resilience Act support period

T

TPM (Trusted Platform Module). A component built to the Trusted Computing Group’s TPM 2.0 Library specification, [28]. TCG describes the TPM as a hardware-based root of trust that generates and stores keys and attests to platform integrity [28]. → Hardware root of trust and secure boot

TrustZone. Arm’s hardware security technology that isolates security-critical firmware, keys and other assets from the rest of the software on the same processor [29]. Arm offers it for Cortex-M microcontrollers and Cortex-A application processors [29][32]. → Hardware root of trust and secure boot

V

VEX (Vulnerability Exploitability eXchange). A form of security advisory stating whether a product is affected by a known vulnerability [30]. Used with an SBOM, it tells customers which of the vulnerabilities in listed components actually matter. → SBOM generation for embedded products; VEX guide

Y

Yocto Project. An open source collaboration project providing templates, tools and methods for building custom Linux-based systems for embedded devices, whatever the hardware architecture [31]. → Embedded systems consulting; embedded Linux and Yocto security hardening

Sources

All accessed 2026-11-10.

  1. MCUboot documentation, "Design" (image slots, swap and revert, security counter). https://docs.mcuboot.com/design.html
  2. Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024. Cited: Art. 3(1), 3(20), 3(29), 3(31), 3(36), 3(39), 3(42); Art. 7, 8, 13(8), 14, 16, 27, 71; Annex I Part II points (1), (5), (6). EUR-Lex, ELI: http://data.europa.eu/eli/reg/2024/2847/oj
  3. Moran, B., Tschofenig, H., Birkholz, H., RFC 9124, "A Manifest Information Model for Firmware Updates in IoT Devices", IETF, January 2022. https://www.rfc-editor.org/rfc/rfc9124
  4. Yocto Project documentation, Reference Manual, "Yocto Project Terms" (Board Support Package). https://docs.yoctoproject.org/ref-manual/terms.html
  5. Regulation (EU) 2023/2854 (Data Act), OJ L, 2023/2854, 22.12.2023. Cited: Art. 1, 2 (definitions), 50. EUR-Lex, ELI: http://data.europa.eu/eli/reg/2023/2854/oj
  6. European Commission, "Data Act explained" (last update 15 December 2025). https://digital-strategy.ec.europa.eu/en/policies/data-act-explained
  7. CISA, "The Coordinated Vulnerability Disclosure (CVD) Program". https://www.cisa.gov/coordinated-vulnerability-disclosure-process
  8. EUR-Lex, document information for Regulation (EU) 2024/2847 (dates of effect). https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32024R2847
  9. CycloneDX, project home page. https://cyclonedx.org/
  10. Ecma International, "ECMA-424". https://www.ecma-international.org/publications-and-standards/standards/ecma-424/
  11. Commission Implementing Decision (EU) 2025/138 of 28 January 2025. EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025D0138
  12. ENISA, "Single Reporting Platform (SRP)". https://www.enisa.europa.eu/topics/product-security-and-certification/single-reporting-platform-srp
  13. ETSI, EN 303 645 V3.1.3 (2024-09), title page. https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf
  14. NIST, SP 800-193, "Platform Firmware Resiliency Guidelines", May 2018. https://csrc.nist.gov/pubs/sp/800/193/final
  15. Regulation (EU) No 1025/2012 on European standardisation, Art. 2(1)(c). EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32012R1025
  16. NIST CSRC Glossary, "Hardware Security Module (HSM)" (citing NIST SP 800-57 Part 2 Rev. 1). https://csrc.nist.gov/glossary/term/hardware_security_module_hsm
  17. ISA, "ISA/IEC 62443 Series of Standards" (published parts and titles). https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
  18. IEC, IEC 62443-4-1:2018, IEC Webstore. https://webstore.iec.ch/en/publication/33615
  19. IEC, IEC 62443-4-2:2019, IEC Webstore. https://webstore.iec.ch/en/publication/34421
  20. Regulation (EU) 2023/1230 on machinery, Art. 1; Annex III section 1.1.9. EUR-Lex, ELI: http://data.europa.eu/eli/reg/2023/1230/oj
  21. EUR-Lex, document information for Regulation (EU) 2023/1230 (application 20/01/2027). https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32023R1230
  22. Moran, B. et al., RFC 9019, "A Firmware Update Architecture for Internet of Things", IETF, April 2021. https://www.rfc-editor.org/rfc/rfc9019
  23. FIRST, "PSIRT Services Framework 1.1". https://www.first.org/standards/frameworks/psirts/psirt_services_framework_v1.1
  24. EUR-Lex, document information for Commission Delegated Regulation (EU) 2022/30. https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32022R0030
  25. European Commission, "Radio Equipment Directive (RED)" page. https://single-market-economy.ec.europa.eu/sectors/electrical-and-electronic-engineering-industries-eei/radio-equipment-directive-red_en
  26. GlobalPlatform, "Introduction to Secure Elements". https://globalplatform.org/resource-publication/introduction-to-secure-elements/
  27. SPDX, "About SPDX: Overview". https://spdx.dev/about/overview/
  28. Trusted Computing Group, "TPM 2.0 Library" specification page. https://trustedcomputinggroup.org/resource/tpm-library-specification/
  29. Arm, "TrustZone for Cortex-M". https://www.arm.com/technologies/trustzone-for-cortex-m
  30. CISA, "Software Bill of Materials (SBOM)" (VEX description). https://www.cisa.gov/sbom
  31. Yocto Project, "About". https://www.yoctoproject.org/about/
  32. Arm, "TrustZone for Cortex-A". https://www.arm.com/technologies/trustzone-for-cortex-a
  33. NIST, "Security Considerations for Code Signing", Cybersecurity White Paper, 26 January 2018. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01262018.pdf
  34. RAUC documentation, "Scenarios". https://rauc.readthedocs.io/en/latest/scenarios.html

Spotted an error? Report it to our corrections log. Read our editorial methodology.