While remaining voluntary, cybersecurity certification maintains a key role in the harmonisation and resilience of the Common Market. Under the Cybersecurity Act (EU 881/2019), and through its privileged position between public institutions, industry and standardisation organisations, ENISA is entrusted with developing and maintaining cybersecurity certification schemes. The involvement of Member States, the Commission and the certification ecosystem (industry, experts, standardization bodies, etc.) is paramount to these schemes' successful delivery. The diverse scope of Information and communication technology (ICT) products and services on the market necessitates the specification of different scopes and requirements per scheme, along with the assignment of different levels of assurance, on the basis of the solution to be certified (basic, substantial, high).
After their adoption, the EU Certification schemes can lead to the issuance of labels (e.g. under the European Cybersecurity Scheme on Common Criteria - EUCC), establish mutual recognition agreements with authorities outside the Common Market, or be used to demonstrate certain products' presumption of conformity to regulatory requirements.
Cyber Resilience Act
The Cyber Resilience Act (CRA) is one of the many regulatory tools whose implementation is complemented by the adoption of cybersecurity certification schemes. By ensuring that products with digital elements (PDEs) maintain a high level of cybersecurity, as well as mandating transparency for their security properties, the CRA ensures that consumers and businesses can be confident that internet-connected hardware and software products will remain secure throughout their lifecycle.
As the CRA enters into effect, PDEs will have to be compliant before being made available on the Common Market. Some manufacturers of PDEs will be required to carry out a self-conformity assessment, while for PDEs designated Important and Critical a third-party conformity assessment will be necessary. PDEs can be presumed to conform with essential requirements, if they comply with harmonised technical standards.
To this end, the EU Commission and EU standards bodies work to identify technical cybersecurity standards, while ENISA has already issued a report mapping existing standards against CRA requirements. These requirements will need to be translated into the form of harmonised standards, with which manufacturers can comply. In support of the standardisation effort, the ENISA report identified the most relevant existing cybersecurity standards for each CRA requirement, analysed the coverage already offered on the intended scope of the requirement and highlighted possible gaps to be addressed.
By blending voluntary and mandatory measures, the EU aims to uphold digital security in a structured and cohesive manner across the Union. Certification schemes developed by ENISA operate in conjunction and complementarity with regulations, making digital products safer for consumers. By certifying their products to a commonly agreed upon degree of trust, stakeholders ensure regulatory compliance while also upholding European resilience to cyber threats.
