3.4 Competences for reviewing reports and making decisions

Personnel in charge of reviewing reports and making conformity assessment decisions shall have knowledge of:

◦ principles of cybersecurity; ◦ design and development of products with digital elements; ◦ for reviews and decisions related to Module H conformity assessments, quality management systems for the development and production of products with digital elements.

techniques

Personnel in charge of reviewing reports and making conformity assessment decisions shall have knowledge of:

◦ cybersecurity specific terminology and documentation structures, hierarchy and interrelationships; ◦ as applicable, cybersecurity aspects of the design and development of products with digital elements; ◦ as applicable and at least for reviews and decisions related to Module H conformity assessments, cybersecurity management related tools, methods, techniques and their application to the design, development and production of products with digital elements; ◦ common vulnerabilities, vulnerability identification and vulnerability management; ◦ cybersecurity risk assessment and risk management; ◦ as applicable and at least for reviews and decisions related to Module B conformity assessments, cryptographic mechanisms ◦ legal and regulatory requirements relevant to cybersecurity.

techniques

Personnel in charge of reviewing reports and making conformity assessment decisions shall have knowledge of:

◦ conformity assessment specific terminology and documentation structures, hierarchy and interrelationships; ◦ evaluation processes and procedures;

◦ evaluation principles, practices and techniques.

Personnel in charge of reviewing reports and making conformity assessment decisions shall have knowledge of relevant conformity assessment schemes, information security standards and other normative documents used in the conformity assessment process.

Personnel in charge of reviewing reports and making conformity assessment decisions shall have knowledge of:

◦ CAB general policies and processes, including information security policies and processes; ◦ for reviews and decisions related to Module B conformity assessments, CAB processes and procedures for the evaluation of products with digital elements; ◦ for reviews and decisions related to Module H conformity assessments, CAB processes and procedures for the audit of quality assurance systems; ◦ if applicable, requirements of the conformity assessment schemes for which the CAB is authorised to work.

NOTE : This knowledge is essential for reviewers, which focuses on the appropriate application of the CAB’s processes and procedures.

Personnel in charge of reviewing reports and making conformity assessment decisions shall have knowledge of generic terminology, processes and technologies related to the client’s business sector.

Personnel in charge of reviewing reports and making conformity assessment decisions shall have knowledge of the categories of products with digital services developed by the client.

NOTE : In the context of CRA, this knowledge is important for reviewers, because of the specific practices that may apply to different categories of products.