What cybersecurity requirements apply to a web browser, a VPN solution, a network management system or an operating system? That is the question four new ETSI standards address. They specify cybersecurity requirements and assessment criteria for each product category, and here we go through what each standard covers.
Web browsers
ETSI EN 304 617 V1.0.0 specifies cybersecurity requirements and assessment criteria for web browsers, both standalone and embedded. Web browsers are software products that enable users to access and interact with web content via local and external networks.
The requirements cover, among other things, secure configuration, handling of security updates, protection against unauthorised access and other fundamental security measures for products with digital elements.
You can find the document here: ETSI EN 304 617 V1.0.0
Virtual Private Networks (VPN)
ETSI EN 304 620 V1.0.0 specifies technical cybersecurity requirements and assessment criteria for products that provide Virtual Private Network (VPN) functionality. The standard covers, among other things, VPN clients and endpoints, nodes in mesh-based VPN networks, and VPN server software and associated remote processing.
The requirements are designed to address cybersecurity risks related to VPN products and cover, among other things, secure communication, authentication, access control, data protection and handling of unauthorised traffic. The standard also includes methods and criteria for assessing whether the technical security requirements are met.
You can find the document here: ETSI EN 304 620 V1.0.0
Network management systems
ETSI EN 304 621 V1.0.5 specifies technical cybersecurity requirements and associated assessment criteria for Network Management Systems (NMS). Such systems are used to monitor, configure and administer network equipment and networks. The standard covers network management systems but excludes systems used in industrial OT environments.
The requirements cover, among other things, secure communication, protection of configuration and information, access control, privacy protection and management of cybersecurity risks. The standard has been developed as a candidate for harmonisation under the EU Cyber Resilience Act (CRA) and is intended to support the assessment of whether the products concerned meet the CRA’s cybersecurity requirements.
You can find the document here: ETSI EN 304 621 V1.0.5
Operating systems
ETSI EN 304 626 V1.0.1 specifies cybersecurity requirements for operating systems and associated assessment criteria. The standard was developed as part of ETSI’s work on the EU Cyber Resilience Act (CRA) and focuses on the security of operating systems used in products with digital components.
The requirements cover, among other things, measures to handle vulnerabilities and strengthen the operating system’s resilience against cyberattacks. The standard provides a common technical framework for assessing whether operating systems meet the relevant cybersecurity requirements under the CRA.
You can find the document here: ETSI EN 304 626 V1.0.1
All feedback and comments on all the standards are welcome by 4 November 2026.
