Products with digital elements shall be designed, developed and produced in such a way that they enable an appropriate level of cybersecurity based on the risks;

be placed on the market without any known exploitable vulnerabilities;

be placed on the market with a secure by default configuration, including the possibility to reset the product to its original state, and including a default setting that security updates be installed automatically according to requirements in point (aaa) of this section and Annex II (9), with a clear and easy-to-use opt-out mechanism.

where applicable under Annex I,1 (3)a of this section, set as a default setting – which can be switched off – that security updates are installed automatically on products with digital elements if not installed within a certain timeframe;

ensure protection from unauthorised access by appropriate control mechanisms, including but not limited to authentication, identity or access management systems;

protect the confidentiality of stored, transmitted or otherwise processed data, personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms;

protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands, programs and configuration against any manipulation or modification not authorised by the user, as well as report on corruptions;

process only data, personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended purpose of the product (‘minimisation of data’);

protect the availability of essential functions, including the resilience against and mitigation of denial of service attacks;

minimise their negative impact by themselves or connected devices on the availability of services provided by other devices or networks;

be designed, developed and produced to reduce the impact of an incident using appropriate exploitation mitigation mechanisms and techniques;

provide security related information by recording and/or monitoring relevant internal activity, including the access to or modification of data, services or functions;

enable that vulnerabilities can be addressed through security updates, including, where applicable, through automatic updates by default, but with a clear and easy-to-use opt-out mechanism, and where applicable through the notification of available updates to users, and the option to temporarily postpone them;

provide the possibility for users to securely and easily remove all data and settings and, where such data can be transferred to other products or systems, ensure this is done in a secure manner.