Main Categories

1.1 
General 
The present document specifies technical requirements and corresponding assessment criteria for operating systems 
related to cybersecurity. The products with digital elements in scope, thereafter "the operating system": 
• are specified within the "technical description" of the "category of product" number 11 of Annex III, Class I by 
the Commission Implementing Regulation (EU) 2025/2392 [i.2] as: 
"software products with digital elements that provide an abstract interface of the underlying hardware and 
control the execution of software, and that may provide services such as computing resource management and 
configuration, scheduling, input-output control, managing data, and providing an interface through which 
applications interact with system resources and peripherals. This category includes but is not limited to real
time operating systems, general-purpose and special-purpose operating systems". 
• are only covered within the product context described in clause 4. 
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the 
Regulation (EU) 2024/2847 [i.1] Annex I Part I under the conditions identified in Annex A. 
The use of harmonised standards is voluntary.