Draft Details

The present document specifies technical requirements and corresponding assessment criteria for Network Management 
Systems related to cybersecurity. The products with digital elements in scope, thereafter "NMS":  
• are specified within the "technical description" of the "category of product" number "6" by the Commission 
Implementing Regulation (EU) 2025/2392 [i.2] as: "Products with digital elements that manage connected 
network elements, such as servers, routers, switches, workstations, printers or mobile devices, by monitoring 
them and controlling their network operations and configuration". 
This category includes but is not limited to end-to-end management systems and dedicated configuration 
management systems, such as controllers for software-defined networking. 
• The products with digital elements in scope are only covered within the product context described in clause 4 
of the present document. 
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the 
Regulation (EU) 2024/2847 [i.1] Annex I Part I under the conditions identified in annex A. 
This includes, but is not limited to, Mobile Device Management systems and Software Defined Networking, e.g when 
an SDN-controller is a stand-alone product using a network management protocol as its South Bound Interface (SBI). 
NMS intended for use in the industrial Operational Technology (OT) [i.18] domain are excluded from the scope of the 
present document. 
An NMS is a product controlling at least partially connected devices with network access. Despite its central 
positioning, an NMS can be an aggregate of several components, including but not limited to: end-to-end management 
systems, dedicated configuration management systems, or controllers for software-defined networking. 
NMS can be composed of several components or can implement additional functions that are outside the scope of the 
present document. 
EXAMPLE: 
Aggregate product design would be an implementation where the operating system acts as an 
abstraction layer for the system(s) that host the NMS, or the networking interfaces.