4.1 Parameters

As indicated in the introduction, a competence is an ability to apply knowledge and skills. A notified body shall assess the competence of the employees performing conformity assessment tasks, using available tools, including:

• Requiring educational credentials (diplomas) on a given field and level.
• Requiring practical experience in a given role and field.
• Administering trainings to personnel.
• Requiring a specific personal certification.

Because the cybersecurity area remains relatively recent, and because there are very limited opportunities to acquire conformity assessment skills through education, it is important to remain very careful with educational requirements ( i.e. , requiring a degree in cybersecurity). Many practitioners are likely to have a general computer science degree, complemented by experience and practical trainings in cybersecurity. It is therefore recommended to define several equivalent profiles for a given qualification level.

For instance, the requirements for an auditor in a Module H assessment could be as follows:

• A Master degree in cybersecurity, plus two years of auditing practice as a junior auditor.
• A Master degree in a field related to cybersecurity 4 , plus four years of practice, including at least two years of auditing practice as a junior auditor.
• A Bachelor degree in cybersecurity, plus four years of practice, including at least two years of auditing practice as a junior auditor.
• A Bachelor degree in a field related to cybersecurity, plus six years of practice, including at least two years of auditing practice as a junior auditor.

Of course, the combinations depend on the role, but it is important to be flexible enough, in order to allow different career paths. In addition, these requirements should be adapted to local practices, and could be open to alternative paths, such as continuing education and other training opportunities.

On a different profile, the requirements for a penetration tester could be quite different (only one example provided, but variants should be considered in a way similar to those proposed for auditors above):

• A Master degree in computer science or electronics, evidence of training related to the use of specific equipment, plus on-the-job training in for at least one year on at least three relevant evaluations;

NOTE : This needs to be further discussed, but for the initial version of this document, and since the main reason for appointing notified bodies is to have them involved in the definition and implementation of initial rules, it seems interesting to focus on practical experience, both for the personnel and for the entity, requiring significant experience in the assessment of the cybersecurity of products with digital elements. In addition, education requirements could be replaced by personal certifications, and the definition of junior auditor need to be refined.

In addition, as indicated in Annex of CRA, in the case of Module H, at least one of the members of the auditing team needs to have experience “as an assessor in the relevant product field and product technology”.

NOTE : This requirement needs to be considered carefully, since it is quite strong, possibly stronger than for a product evaluator (since many of the competences are assigned to the evaluation team rather than an individual evaluator). It may be interesting to define a specific category for this specific role.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

• ENISA -