An Operational Description is a critical part of cybersecurity compliance, detailing how your product functions in real-world use—its software, hardware, connectivity, and security controls. For manufacturers, a clear and compliant operational description can streamline certification processes, reduce questions from assessors, and demonstrate to regulators that security is built into your design. At 360Compliance, we help you craft operational descriptions that align with ETSI EN 303 645, the CE RED Delegated Act, and the EU Cyber Resilience Act so your products are audit-ready, secure, and globally marketable.
What Is an Operational Description?
An operational description explains the internal and external workings of a device or system. It covers:
- Functional architecture — components, modules, communication flows
- Interfaces & network topology — how devices talk to each other or to the cloud (see our Topology Compliance page)
- Security controls in practice — authentication, encryption, update mechanisms
- Operational modes / use cases — normal operation, failure modes, maintenance
👉 For the official framework, see the Radio Equipment Directive on EUR-Lex.
Key Components of an Operational Description
A compliance-ready document should include:
- Device overview: OS, firmware, chipset details
- Data flows: what data moves where, how it’s protected
- Interface descriptions: USB, WiFi, BLE, etc.
- Cryptography & key management
- Update and patch processes
- Vulnerability disclosure & incident handling
- Power, boot, safe mode, fallback behavior
- Differences among variants (linked to Family of Products documentation)
Why Operational Descriptions Matter in Compliance
Operational descriptions help you:
- Reduce delays in certification — by preempting assessor questions
- Demonstrate “security by design” to regulators under EN 303 645, RED, and CRA
- Support product families — clearly mapping variants to a base design
- Increase trust — showing customers you know how your product works from a security perspective
Our Operational Description Services
At 360Compliance, we support manufacturers with:
- Drafting operational descriptions for IoT, ICT, and radio devices
- Reviewing documentation to ensure CE/UKCA compliance
- Aligning with CRA, RED, EN 18031, and EN 303 645 requirements
- Supporting cybersecurity audits and technical reviews
- Providing end-to-end certification guidance
Steps to Produce a Compliant Operational Description
- Collect architecture data — system internals, modules, interfaces
- Model data flows and threat paths
- Map to security controls — show how each requirement is met
- Draft document & diagrams
- Review & iterate with engineering / security teams
- Validate in test / field conditions
- Finalize for inclusion in your technical file / DoC
Frequently Asked Questions
Is an operational description mandatory?
While not always explicitly mandated, it is commonly expected by certification and conformity assessors to explain how your security controls function in practice.
Does it replace testing reports?
No — it complements them. The operational description documents how the product should behave; tests show what happens under attack.
Does each variant need its own description?
If variants differ significantly, yes. But for product families you can reference a base document with variant-specific notes.
Why Choose 360Compliance?
Preparing an Operational Description that satisfies regulators and certification bodies can be complex and time-consuming. At 360Compliance, we provide expert support to ensure your documentation is accurate, complete, and aligned with global cybersecurity and compliance requirements.
Our services include:
-
End-to-End Documentation Support – From initial product analysis to final submission, we help prepare operational descriptions that meet EU and UK requirements.
-
Cybersecurity Expertise – We ensure your documentation clearly reflects how security features (encryption, authentication, updates) are implemented in practice.
-
Global Market Access – By aligning with frameworks such as EN 303 645, the CE RED Delegated Act, and the EU Cyber Resilience Act, we help ensure your devices are market-ready.
-
Consistency Across Product Families – We prepare operational descriptions that support product variants and family compliance, reducing duplication and cost.
-
Fixed Pricing – Transparent pricing with no hidden fees, giving you clarity and control over compliance budgets.
Secure your connected devices and simplify the certification process by partnering with 360Compliance. Contact us today to get started on preparing your operational description and ensuring seamless global market access
