1. Introduction

In line with DG.CNCT.H2 request 1 , this document is ENISA’s contribution on the competence requirements for the notified bodies that will be allowed to perform conformity assessment activities on behalf of the vendors of products with digital elements to demonstrate their compliance to the Cyber Resilience Act (CRA).

The notified bodies (NBs) should be assessed by the Notifying Authorities (NAs) and others bodies involved in the assessment, designation and monitoring of notified bodies. The conformity assessment bodies (CABs) wishing to be notified could use the accreditations against the preferred ISO 17000 series standards 2 in order to demonstrate the conformity with the requirements. In this case, National Accreditation Bodies (NABs) should be involved in the assessment and monitoring.

The Notifying Authorities will remain solely responsible for the all the processes: assessment, monitoring, designation and notification even they may delegate some of these functions to others bodies.

As the requirements for CABs wishing to be notified should be evaluated by the Notifying Authorities, the personnel for Notifying Authorities should have the knowledge, experience and training to assess all requirements for CABs wishing to be notified.

The document focuses on high-level competences which will be required to perform conformity assessment activities, in particular the experience and training requirements for the personnel employed by a CAB wishing to be notified (CRA NB) – especially those used as auditors / evaluators. These competences need to be complemented with the specific competences required to demonstrate conformity of products with the harmonised standards that are currently under development 3 .

As the document focuses on competence requirements, it does not fully cover conformity to conformity assessment standards ( e.g. , the application of processes is not covered, except from a competence viewpoint). Nevertheless, it uses the terminology defined for harmonised standard EN ISO/IEC 17000 [1], and it assumes that the activities are organised following the principles of the EN ISO/IEC 17065 [2] or EN ISO/IEC 17021-1 [3] standards.

This document does not cover legal requirements, including proof of liability insurance, organisational requirements, including independence and impartiality, processes requirements, including internal Quality System, facilities requirements, or subcontracting requirements.

In order to produce the following document, the following standards have been used:

• EN ISO/IEC 17065 is the harmonised standard for the certification of products, services and processes, relevant for product-related activities.
• EN ISO/IEC 17021-1 is the harmonised standard for the certification of management systems, relevant in particular for activities related to quality management systems and quality assurance systems.
• EN ISO/IEC 17020 [4] and EN ISO/IEC 17025 [5] are the harmonised standards for respectively, inspection and testing, relevant to some product-related activities.
• EN ISO/IEC 17000 defines common terminology for conformity assessment, here complemented by some terminology related to competences and their assessment defined in EN ISO/IEC 17024, the standard for the certification of persons.
• ISO/IEC TS 17027 [6] defines additional terminology related to competences of persons
• ISO/IEC 19896-3 [7] defines knowledge, skills and effectiveness requirements for Common Criteria evaluators.