+3.1 Overview

3.1 Overview

The table below, inspired from CEN TS 18072’s Annex A [8], defines the knowledge and skills required for the different roles, which are then defined in greater details in the rest of the section.

In the table below, a “B” indicates a competence requirement for Module B assessments, an “H” indicates a competence requirement for Module H assessments and an “(X)” indicates a conditional competence requirement (typically, a requirement for all stakeholders involved in a related activity). The assumption is here that a conformity assessment body may be notified for performing only some activities (e.g., Module B assessments, but no module H assessments). A “X*” indicates a partial coverage of a competence requirement.

The following guidelines can be used:

A mark in the “ Evaluator ” column indicates knowledge and skills that are required for all relevant evaluators.
A mark in the “ Evaluation lead ” column indicates knowledge and skills that are required for lead evaluators, in addition to the other skills of an evaluator, or with higher expectation levels.
A mark in the “ Evaluation team ” column indicates knowledge and skills that are required for at least one member of the evaluation team.
A mark in the “ Personnel preparing the evaluation ” column indicates knowledge and skills that are required for the persons involved in the application review to determine the evaluation team competence required, to select the evaluation team members and to determine the evaluation time
A mark in the “ Personnel reviewing reports and making decisions ” column indicates knowledge and skills that are required for the person in charge of reviewing reports and making conformity assessment decisions.

In all cases, additional details are provided below.

Figure 2: Summary of knowledge and skills

Competences

r o ta u la v E

n o ita u la v E

d a e l

n o ita u la v E

m a e t

le n n o s r e P

g n ir a p e r p

e h t

n o ita u la v e

le n n o s r e P

g n iw e iv e r

d n a s tr o p e r

g n ik a m

s n o is ic e d

Knowledge of common industry

See 3.2.1

See 3.3.1

See 3.4.1

practices

principles of cybersecurity		B/H	B/H	B/H
	design and development of products	B/H		B/H

with digital elements

Competences

r o ta u la v E

n o ita u la v E

d a e l

n o ita u la v E

m a e t

le n n o s r e P

g n ir a p e r p

e h t

n o ita u la v e

le n n o s r e P

g n iw e iv e r

d n a s tr o p e r

g n ik a m

s n o is ic e d

quality assurance systems for the development and production of products with digital elements

technical knowledge of products with

B/H

digital elements

Knowledge of information security terminology, principles, practices and techniques		See 3.2.2	–	See 3.2.2	See 3.3.2	See 3.4.2
	cybersecurity specific terminology and	B/H			B/H	B/H

documentation structures, hierarchy

and interrelationships

cybersecurity aspects of the design and development of products with digital elements, including secure development life cycle		(B/H)	B/H	B/H
	cybersecurity management related	(B/H)	B/H	(B)/H

tools, methods, techniques and their

application to the design, development

and production of products with digital

elements

common vulnerabilities, vulnerability identification and vulnerability management		B/H	B/H	B/H
	cybersecurity risk assessment and risk	B/H		B/H

management

cryptographic mechanisms		B	H	B/(H)
	current technology where information		B/H

security may be relevant or an issue

legal and regulatory requirements relevant to cybersecurity				B/H		B/H
	Knowledge of conformity	See 3.2.3	–	See 3.2.3	See 3.3.3	See 3.4.3

assessment terminology, principles,

practices and techniques

conformity assessment specific terminology and documentation structures, hierarchy and interrelationships		B/H						B/H		B/H
	evaluation processes and procedures		(B/H)		B/H		B/H				B/H
evaluation principles, practices and techniques		(B/H)		B/H		B/H				B/H
	Evaluation skills		See 3.2.4		See 3.2.4		See 3.2.4		–		–
testing skills		(B)				B/H
	examination skills		(B/H)				B/H

Competences

r o ta u la v E

n o ita u la v E

d a e l

n o ita u la v E

m a e t

le n n o s r e P

g n ir a p e r p

e h t

n o ita u la v e

le n n o s r e P

g n iw e iv e r

d n a s tr o p e r

g n ik a m

s n o is ic e d

auditing skills

B/H

language skills

B/H

note-taking and report-writing skills

B/H

presentation skills

B/H

interviewing skills

Knowledge of specific standards and

See 3.2.5

–

See 3.2.5

See 3.3.4

See 3.4.4

normative documents

relevant conformity assessment schemes, information security standards and other normative documents used in the conformity assessment process		B/H		B/H	B/H
	relevant cybersecurity requirements, as		B/H

defined in schemes, standards and

other normative documents

relevant cybersecurity evaluation methodologies, as defined in schemes, standards and other normative documents				B/H
	Knowledge of conformity	See 3.2.6	–	–	See 3.3.5	See 3.4.5

assessment body’s processes

CAB general policies and processes, including information security policies and processes		B/H	B/H	B/H
	CAB processes and procedures for the	B		B

evaluation of products with digital

elements

CAB processes and procedures for the audit of quality management systems		H					H
	CAB approved evaluation methods		(B/H)
requirements of the conformity assessment schemes for which the CAB is authorised to work		(B/H)				(B/H)	(B/H)
	Knowledge of client’s business	See 3.2.7		–	See 3.2.7	See 3.3.6	See 3.4.6

sector

the legal and regulatory requirements in the particular information security field, geography and jurisdictions(s)			B/H
	information security risks related to the	B/H

client’s business sector

Competences

r o ta u la v E

n o ita u la v E

d a e l

n o ita u la v E

m a e t

le n n o s r e P

g n ir a p e r p

e h t

n o ita u la v e

le n n o s r e P

g n iw e iv e r

d n a s tr o p e r

g n ik a m

s n o is ic e d

generic terminology, processes and technologies related to the client’s business sector

B/H

relevant business sector practices

(B/H)

Knowledge of client products, processes and organisation

–

See 3.2.8

See 3.3.7

See 3.4.7

the impact of organization type, size,

B/H

governance, structure, functions and

relationships on the design,

development and production of the

product with digital elements

categories of products with digital services developed by the client						B/H			B/H
	Evaluation management skills		See 3.2.9		See 3.2.9		–	–		–
conducting and managing evaluation activities		B/H		B/H
	knowledge and skills to manage the			B/H

evaluation process and the evaluation

team

1. Forbhreathnú

Teideal	Caighdeán

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

Ceanglais
Foinse	Ceanglas

3. Rialacháin ghaolmhara

Rialacháin
Foinse	Rialáil

ENISA -