+3. Required Knowledge and Skills
---+3.1 Overview
---+3.2 Competences for performing evaluations
------+3.2.1 Knowledge of common industry practices
------+3.2.2 Knowledge of information security terminology, principles, practices and
------+3.2.3 Knowledge of conformity assessment terminology, principles, practices and
------+3.2.4 Evaluation skills
------+3.2.5 Knowledge of specific standards and normative documents
------+3.2.6 Knowledge of conformity assessment body’s processes
------+3.2.7 Knowledge of client’s business sector
------+3.2.8 Knowledge of client products, processes and organisation
------+3.2.9 Evaluation management skills
---+3.3 Competences for preparing evaluations
------+3.3.1 Knowledge of common industry practices
------+3.3.2 Knowledge of information security terminology, principles, practices and
------+3.3.3 Knowledge of conformity assessment terminology, principles, practices and
------+3.3.4 Knowledge of specific standards and normative documents
------+3.3.5 Knowledge of conformity assessment body’s processes
------+3.3.6 Knowledge of client’s business sector
------+3.3.7 Knowledge of client products, processes and organisation
---+3.4 Competences for reviewing reports and making decisions
------+3.4.1 Knowledge of common industry practices
------+3.4.2 Knowledge of information security terminology, principles, practices and
------+3.4.3 Knowledge of conformity assessment terminology, principles, practices and
------+3.4.4 Knowledge of specific standards and normative documents
------+3.4.5 Knowledge of conformity assessment body’s processes
------+3.4.6 Knowledge of client’s business sector
------+3.4.7 Knowledge of client’s products, processes and organisations
|
3. Required Knowledge and Skills
Required Knowledge and Skills
1. Áttekintés
| Megnevezés |
Szabvány |
|
3.1 Overview
|
The table below, inspired from CEN TS 18072’s Annex A [8], defines the knowledge and skills required for the different roles, which are then defined in greater details in the rest of the section. In the table below, a “B” indicates a competence requirement for Module B assessments, an “H” indicates a competence requirement for Module H assessments and an “(X)” indicates a conditional competence requirement (typically, a requirement for all stakeholders involved in a related activity). The assumption is here that a conformity assessment body may be notified for performing only some activities (e.g., Module B assessments, but no module H assessments). A “X*” indicates a partial coverage of a competence requirement. The following guidelines can be used: - A mark in the “ Evaluator ” column indicates knowledge and skills that are required for all relevant evaluators.
- A mark in the “ Evaluation lead ” column indicates knowledge and skills that are required for lead evaluators, in addition to the other skills of an evaluator, or with higher expectation levels.
- A mark in the “ Evaluation team ” column indicates knowledge and skills that are required for at least one member of the evaluation team.
- A mark in the “ Personnel preparing the evaluation ” column indicates knowledge and skills that are required for the persons involved in the application review to determine the evaluation team competence required, to select the evaluation team members and to determine the evaluation time
- A mark in the “ Personnel reviewing reports and making decisions ” column indicates knowledge and skills that are required for the person in charge of reviewing reports and making conformity assessment decisions.
In all cases, additional details are provided below. Figure 2: Summary of knowledge and skills | Competences | | | r o ta u la v E | | n o ita u la v E | d a e l | | n o ita u la v E | m a e t | | le n n o s r e P | g n ir a p e r p | e h t | n o ita u la v e | | le n n o s r e P | g n iw e iv e r | d n a s tr o p e r | g n ik a m | s n o is ic e d | | Knowledge of common industry | See 3.2.1 | | See 3.2.1 | | | See 3.2.1 | | | See 3.3.1 | | | | | See 3.4.1 | | | | | |
practices | principles of cybersecurity | | B/H | B/H | B/H | | design and development of products | B/H | | B/H |
with digital elements | Competences | | | r o ta u la v E | n o ita u la v E | d a e l | | n o ita u la v E | m a e t | le n n o s r e P | g n ir a p e r p | e h t | n o ita u la v e | | le n n o s r e P | g n iw e iv e r | d n a s tr o p e r | g n ik a m | s n o is ic e d | | quality assurance systems for the development and production of products with digital elements | | H | | | | | | | | | | | H | | | | | | | technical knowledge of products with | | | | | B/H | | | | | | | | | | | | |
digital elements | Knowledge of information security terminology, principles, practices and techniques | | See 3.2.2 | – | See 3.2.2 | See 3.3.2 | See 3.4.2 | | cybersecurity specific terminology and | B/H | | | B/H | B/H |
documentation structures, hierarchy and interrelationships | cybersecurity aspects of the design and development of products with digital elements, including secure development life cycle | | (B/H) | B/H | B/H | | cybersecurity management related | (B/H) | B/H | (B)/H |
tools, methods, techniques and their application to the design, development and production of products with digital elements | common vulnerabilities, vulnerability identification and vulnerability management | | B/H | B/H | B/H | | cybersecurity risk assessment and risk | B/H | | B/H |
management | cryptographic mechanisms | | B | H | B/(H) | | current technology where information | | B/H | |
security may be relevant or an issue | legal and regulatory requirements relevant to cybersecurity | | | | B/H | | B/H | | Knowledge of conformity | See 3.2.3 | – | See 3.2.3 | See 3.3.3 | See 3.4.3 |
assessment terminology, principles, practices and techniques | conformity assessment specific terminology and documentation structures, hierarchy and interrelationships | | B/H | | | | | | B/H | | B/H | | | evaluation processes and procedures | | (B/H) | | B/H | | B/H | | | | B/H | | evaluation principles, practices and techniques | | (B/H) | | B/H | | B/H | | | | B/H | | | Evaluation skills | | See 3.2.4 | | See 3.2.4 | | See 3.2.4 | | – | | – | | testing skills | | (B) | | | | B/H | | | | | | | examination skills | | (B/H) | | | | B/H | | | | |
| Competences | | | | r o ta u la v E | | | n o ita u la v E | d a e l | | n o ita u la v E | m a e t | | le n n o s r e P | g n ir a p e r p | e h t | n o ita u la v e | | le n n o s r e P | g n iw e iv e r | d n a s tr o p e r | g n ik a m | s n o is ic e d | | auditing skills | | H | | | | | | | B/H | | | | | | | | | | | | | | | language skills | | B/H | | | | | | | | | | | | | | | | | | | | | note-taking and report-writing skills | | B/H | | | B/H | | | | | | | | | | | | | | | | | | | presentation skills | | H | | | B/H | | | | | | | | | | | | | | | | | | interviewing skills | | H | | | | | | | B | | | | | | | | | | | | | | | Knowledge of specific standards and | See 3.2.5 | | | – | | | | See 3.2.5 | | | See 3.3.4 | | | | | See 3.4.4 | | | | | |
normative documents | relevant conformity assessment schemes, information security standards and other normative documents used in the conformity assessment process | | B/H | | B/H | B/H | | relevant cybersecurity requirements, as | | B/H | | |
defined in schemes, standards and other normative documents | relevant cybersecurity evaluation methodologies, as defined in schemes, standards and other normative documents | | | | B/H | | | | Knowledge of conformity | See 3.2.6 | – | – | See 3.3.5 | See 3.4.5 |
assessment body’s processes | CAB general policies and processes, including information security policies and processes | | B/H | B/H | B/H | | CAB processes and procedures for the | B | | B |
evaluation of products with digital elements | CAB processes and procedures for the audit of quality management systems | | H | | | | | H | | CAB approved evaluation methods | | (B/H) | | | | | | requirements of the conformity assessment schemes for which the CAB is authorised to work | | (B/H) | | | | (B/H) | (B/H) | | Knowledge of client’s business | See 3.2.7 | | – | See 3.2.7 | See 3.3.6 | See 3.4.6 |
sector | the legal and regulatory requirements in the particular information security field, geography and jurisdictions(s) | | | B/H | | information security risks related to the | B/H | |
client’s business sector | Competences | | | | r o ta u la v E | | n o ita u la v E | d a e l | | n o ita u la v E | m a e t | | le n n o s r e P | g n ir a p e r p | e h t | n o ita u la v e | | le n n o s r e P | g n iw e iv e r | d n a s tr o p e r | g n ik a m | s n o is ic e d | | generic terminology, processes and technologies related to the client’s business sector | | B/H | | | | | | | | | B/H | | | | | B/H | | | | | | | relevant business sector practices | | (B/H) | | | | | | | | | | | | | | | | | | | | Knowledge of client products, processes and organisation | | – | | | – | | | See 3.2.8 | | | See 3.3.7 | | | | | See 3.4.7 | | | | | | | the impact of organization type, size, | | | | | | | B/H | | | B/H | | | | | | | | | | |
governance, structure, functions and relationships on the design, development and production of the product with digital elements | categories of products with digital services developed by the client | | | | | | B/H | | | B/H | | | Evaluation management skills | | See 3.2.9 | | See 3.2.9 | | – | – | | – | | conducting and managing evaluation activities | | B/H | | B/H | | | | | | | | knowledge and skills to manage the | | | B/H | | | | | | |
evaluation process and the evaluation team
|
|
3.2 Competences for performing evaluations
|
This section covers the competences of the personnel performing evaluations, which includes the individual evaluators, the evaluation lead, and the evaluation team. NOTE : Evaluation covers all selection and determination activities, including inspection, audit, testing, validation and verification.
|
|
3.3 Competences for preparing evaluations
|
This section covers the competences of the personnel involved in the application review to determine the evaluation team competence required, to select the evaluation team members and to determine the evaluation time. NOTE : These personnel may be involved in the performance of evaluations or not, but they need to have enough knowledge to understand how an evaluation is performed, the set of skills that will be required for a given evaluation and the time required to perform the evaluation However, this role does not require any operational skills on the performance of evaluation activities.
|
|
3.4 Competences for reviewing reports and making decisions
|
This section covers the competences of the personnel in charge of reviewing reports and making conformity assessment decisions. NOTE : These personnel are essential in a conformity assessment body. They also need to be independent from those performing the conformity assessment activities, while mastering many of their competences, with the notable exception of the skills to actually perform the conformity assessment activities. These personnel provide the guarantee that the processes and procedures defined by the notified body are appropriately applied in every conformity assessment project.
|
1.1 Hivatkozások
1.2 Azonosított követelmények
1.3 Kapcsolódó szabályozások
2. Azonosított követelmények
Követelmények
| Forrás |
Követelmény |
3. Kapcsolódó szabályozások
Szabályozások
| Forrás |
Szabályozás |
- ENISA -
EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.
DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.
|