3.2 Competences for performing evaluations

Every evaluator involved in the evaluation of products with digital elements shall have knowledge of:

◦ principles of cybersecurity; ◦ design and development of products with digital elements.

This is general knowledge, which shall be understood by all personnel involved in the evaluation, even if their tasks are very specialised.

In addition, evaluators participating to assessments based on Module H shall have knowledge of quality assurance systems for the development and production of products with digital elements.

Finally, collectively, the evaluation team involved in the evaluation of products with digital elements shall have technical knowledge of products with digital elements. This is much more specific knowledge, so each member of the team is expected to cover a part of the required knowledge.

techniques

Every evaluator involved in the evaluation of products with digital elements shall have knowledge of:

◦ cybersecurity specific terminology and documentation structures, hierarchy and interrelationships; ◦ as applicable, cybersecurity aspects of the design and development of products with digital elements, including secure development life cycle; ◦ as applicable, cybersecurity management related tools, methods, techniques and their application to the design, development and production of products with digital elements; ◦ common vulnerabilities, vulnerability identification and vulnerability management; ◦ cybersecurity risk assessment and risk management; ◦ as applicable, cryptographic mechanisms.

NOTE : When a topic is marked as “as applicable”, then it only applies to the evaluators who need the knowledge in order to perform their evaluation activities. For instance, a tester may not need knowledge on design and development, but an inspector or an auditor may need that knowledge, and may also need some knowledge on cybersecurity management related tools and techniques.

In addition, regardless of the type of evaluation, the evaluation team involved in the evaluation of products with digital elements shall have technical knowledge of all these, as well as of

◦ current technology where information security may be relevant or an issue; ◦ legal and regulatory requirements relevant to cybersecurity.

NOTE : The use of the adjective “current” indicates that it is particularly important for this matter to keep the knowledge on technologies up-to-date.

NOTE : Contrarily to CEN TS 18072, which only requires knowledge about legal and regulatory requirements for certifiers, we have considered that these requirements needed to be covered in the evaluation team in the context of CRA.

techniques

Every evaluator involved in the evaluation of products with digital elements shall have knowledge of:

◦ conformity assessment specific terminology and documentation structures, hierarchy and interrelationships; ◦ as applicable, evaluation processes and procedures; ◦ evaluation principles, and as applicable, evaluation practices and techniques.

In addition, evaluation leads shall have knowledge of:

◦ evaluation processes and procedures; ◦ evaluation principles, practices and techniques.

NOTE : This element is more detailed than in CEN TS 18072, and its content could be discussed. In particular, we propose to only require evaluators to know the processes and procedures, as well as the practices and techniques that are relative to the evaluation activities that they perform. Evaluation leads, on the other hands, need to have transversal knowledge of these aspects.

Every evaluator involved in the evaluation of products with digital elements shall have technical skills, including as applicable:

◦ testing skills; ◦ inspection skills; ◦ auditing skills

Inspection skills shall be complemented as required by sufficient competences to form a professional judgment. In addition, every evaluator involved in the evaluation of products with digital elements shall have general skills, including:

◦ language skills; ◦ note-taking and report-writing skills; ◦ as applicable, presentation skills; ◦ as applicable, interviewing skills.

In addition, collectively, the evaluation team involved in the evaluation of products with digital elements shall have knowledge of testing and inspection skills.

NOTE : For Module H, at least one member of the evaluation team needs to have product-specific competencies, including an assessment of the deliverables provided by the manufacturer [9].

NOTE : For Module B, the periodic audits of the vulnerability handling processes used by the manufacturer is considered also covered by EN ISO/IEC 17065 without specific EN ISO/IEC 17021-1 competence [9].

Evaluation leads shall have a higher level of report-writing and presentation skills, in order to report the findings to the clients in written and oral forms.

NOTE : The description of the skills needs to be much more detailed, in particular for the technical skills related to product assessment (inspection and testing). This information is likely to be defined in (or easily derived from) harmonised standards. In the meantime, the competences will be linked to the evaluation methodology defined by the CAB to perform the evaluation.

Every evaluator involved in the evaluation of products with digital elements shall have knowledge of:

◦ relevant conformity assessment schemes, information security standards and other normative documents used in the conformity assessment process;

NOTE : This is general knowledge, required for all evaluators, and the more specific knowledge of the requirements and methodologies are only required for the evaluation team.

In addition, collectively, the evaluation team involved in the evaluation of products with digital elements shall have knowledge of

◦ relevant cybersecurity requirements, as defined in schemes, standards and other normative documents; ◦ relevant cybersecurity evaluation methodologies, as defined in schemes, standards and other normative documents

NOTE : Harmonised standards are expected to provide a reference framework, from which more detailed requirements and activities will be derived. Before the availability of these harmonised standards, ENISA and the JRC have identified a set of standards that may be of interest [10].

Every evaluator involved in the evaluation of products with digital elements shall have knowledge of:

◦ CAB general policies and processes, including information security policies and processes; ◦ for evaluators involved in Module B assessments, CAB processes and procedures for the evaluation of products with digital elements; ◦ for evaluators involved in Module H assessments, CAB processes and procedures for the audit of quality assurance systems; ◦ as applicable, CAB approved evaluation methods; ◦ as applicable, requirements of the conformity assessment schemes for which the CAB is authorised to work.

NOTE : More details may be required about the processes that are relevant for a given type of conformity assessment, but evaluators may be specialised in a particular kind of assessment. For instance, when implementing Module B, testing procedures have to be known, whereas for Module H, the focus would be on auditing procedures, which is why “as applicable” has been used here.

Every evaluator involved in the evaluation of products with digital elements shall have knowledge of:

◦ information security risks related to business sector;

◦ generic terminology, processes and technologies related to the client’s business sector; ◦ as applicable, relevant business sector practices.

In addition, collectively, the evaluation team involved in the evaluation of products with digital elements shall have knowledge of the legal and regulatory requirements in the particular information security field, geography and jurisdictions(s).

NOTE : There needs to be a discussion about the relationship between “business sectors” and the “product categories” defined in the CRA. Harmonised standards will define risks, and they are likely to identify specific technical aspects and business practices specific to a business sector. A single business sector may correspond to several product categories ( e.g. , the semiconductor sector covers several product categories), so a good practice would be to list the CRA product categories covered by the business sector.

Collectively, the evaluation team involved in the evaluation of products with digital elements shall have knowledge of:

◦ the impact of organization type, size, governance, structure, functions and relationships on the design, development and production of the product with digital elements; ◦ the categories of products with digital services developed by the client.

The CRA requires in Annex VIII, Part IV, section 3.3 that the “team shall have at least one member experienced as an assessor in the relevant product field and product technology concerned, and shall have knowledge of the applicable requirements set out in this Regulation”. Knowledge related to the product corresponds to the ability to make professional judgments related to the product requirements, which should be demonstrated via application of EN ISO/IEC 17020 clauses 6.1.2 to 6.1.3, and 6.1.6 to 6.1.10 [11].

Every evaluator involved in the evaluation of products with digital elements shall be skilled at conducting and managing evaluation activities.

In addition, every evaluation lead shall have deeper knowledge of the evaluation activities, as well as the knowledge and skills to manage the certification evaluation process and the evaluation team.

NOTE : Every evaluator shall have the ability to manage its own activities and report to the evaluation lead, who shall then have the required skills to support the evaluators and to coordinate the evaluators in the team.