3.2.2 Knowledge of information security terminology, principles, practices and

techniques

Every evaluator involved in the evaluation of products with digital elements shall have knowledge of:

◦ cybersecurity specific terminology and documentation structures, hierarchy and interrelationships; ◦ as applicable, cybersecurity aspects of the design and development of products with digital elements, including secure development life cycle; ◦ as applicable, cybersecurity management related tools, methods, techniques and their application to the design, development and production of products with digital elements; ◦ common vulnerabilities, vulnerability identification and vulnerability management; ◦ cybersecurity risk assessment and risk management; ◦ as applicable, cryptographic mechanisms.

NOTE : When a topic is marked as “as applicable”, then it only applies to the evaluators who need the knowledge in order to perform their evaluation activities. For instance, a tester may not need knowledge on design and development, but an inspector or an auditor may need that knowledge, and may also need some knowledge on cybersecurity management related tools and techniques.

In addition, regardless of the type of evaluation, the evaluation team involved in the evaluation of products with digital elements shall have technical knowledge of all these, as well as of

◦ current technology where information security may be relevant or an issue; ◦ legal and regulatory requirements relevant to cybersecurity.

NOTE : The use of the adjective “current” indicates that it is particularly important for this matter to keep the knowledge on technologies up-to-date.

NOTE : Contrarily to CEN TS 18072, which only requires knowledge about legal and regulatory requirements for certifiers, we have considered that these requirements needed to be covered in the evaluation team in the context of CRA.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.