SPREN1 Logs

Product security covers what is sold (devices, software, customer cloud services) and struggles with lifecycles, no access to live systems and many target markets. Information security covers the company's own IT and struggles with governance, asset inventory, monitoring and lega...

Quiz: SPREN1 / Product Security: Drivers, Laws and Standards | updated: Oct 13, 2026

Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026. All other requirements apply from 11 December 2027. 41 harmonised standards are being developed: horizontal ones (the EN 40000-1 series) and vertical ones per product group. * Re...

Quiz: SPREN1 / Product Security: Drivers, Laws and Standards | updated: Oct 13, 2026

Hard skills in cybersecurity, systems engineering, IT architecture, software development, auditing and process management, plus resilience, organisation, persuasiveness and persistence. They face growing complexity, resistance from product management, pressure for faster and chea...

Quiz: SPREN1 / Product Security: Drivers, Laws and Standards | updated: Oct 13, 2026

Default allows self-assessment. Important class I allows self-assessment only with a harmonised standard, otherwise third-party. Important class II requires a third-party assessment. Critical requires third-party and may require an EU cybersecurity certificate (EUCC). * The more...

Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | updated: Oct 13, 2026

Identify and mitigate the security risks in the product design proactively, and keep residual risk acceptable. It delivers a threat model, a risk assessment, a mitigation plan, and the acceptance and monitoring of residual risks. * Step five feeds back into step two: a threat mo...

Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | updated: Oct 13, 2026

Risks: vulnerable or hallucinated code, sprawling dependencies, leaked IP and secrets, AI-assisted reverse engineering, licence violations, skill erosion. Measures: treat AI as a tool, verify manually, test everything, scan for secrets and licences, monitor AI use, apply DLP and...

Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | updated: Oct 13, 2026

Speed up secure development by automating security testing and configuration in the CI/CD pipeline. The pitfalls are allowing merges to production despite coding errors, and deploying directly to production. DevSecOps builds security into DevOps. The checks a security team would...

Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | updated: Oct 13, 2026

IT protects the confidentiality, integrity and availability of information. OT protects the safety, reliability and availability of physical processes. Because OT downtime can endanger people or equipment, OT tolerates almost no downtime and is updated with great caution. * IT p...

Quiz: SPREN1 / Product Security: Drivers, Laws and Standards | updated: Oct 13, 2026

A process standard says how to develop securely (activities, roles, lifecycle), for example IEC 62443-4-1, ISO/SAE 21434 or Microsoft SDL. A control standard says which security measures the product must have, for example IEC 62443-4-2, ETSI EN 303 645 or FIPS 140-3. Process s...

Quiz: SPREN1 / Product Security: Drivers, Laws and Standards | updated: Oct 13, 2026

Senior management decides and provides resources; the Chief Product Security Officer owns strategy and policy; product security officers support projects and assessments; architects define security architectures; analysts (often a PSIRT) handle vulnerabilities and disclosure; sec...

Quiz: SPREN1 / Product Security: Drivers, Laws and Standards | updated: Oct 13, 2026