3.2.2 Knowledge of information security terminology, principles, practices and

techniques

Every evaluator involved in the evaluation of products with digital elements shall have knowledge of:

◦ cybersecurity specific terminology and documentation structures, hierarchy and interrelationships; ◦ as applicable, cybersecurity aspects of the design and development of products with digital elements, including secure development life cycle; ◦ as applicable, cybersecurity management related tools, methods, techniques and their application to the design, development and production of products with digital elements; ◦ common vulnerabilities, vulnerability identification and vulnerability management; ◦ cybersecurity risk assessment and risk management; ◦ as applicable, cryptographic mechanisms.

NOTE : When a topic is marked as “as applicable”, then it only applies to the evaluators who need the knowledge in order to perform their evaluation activities. For instance, a tester may not need knowledge on design and development, but an inspector or an auditor may need that knowledge, and may also need some knowledge on cybersecurity management related tools and techniques.

In addition, regardless of the type of evaluation, the evaluation team involved in the evaluation of products with digital elements shall have technical knowledge of all these, as well as of

◦ current technology where information security may be relevant or an issue; ◦ legal and regulatory requirements relevant to cybersecurity.

NOTE : The use of the adjective “current” indicates that it is particularly important for this matter to keep the knowledge on technologies up-to-date.

NOTE : Contrarily to CEN TS 18072, which only requires knowledge about legal and regulatory requirements for certifiers, we have considered that these requirements needed to be covered in the evaluation team in the context of CRA.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

• ENISA -