4. Competence requirements

As indicated in the introduction, a competence is an ability to apply knowledge and skills. A notified body shall assess the competence of the employees performing conformity assessment tasks, using available tools, including:

• Requiring educational credentials (diplomas) on a given field and level.
• Requiring practical experience in a given role and field.
• Administering trainings to personnel.
• Requiring a specific personal certification.

Because the cybersecurity area remains relatively recent, and because there are very limited opportunities to acquire conformity assessment skills through education, it is important to remain very careful with educational requirements ( i.e. , requiring a degree in cybersecurity). Many practitioners are likely to have a general computer science degree, complemented by experience and practical trainings in cybersecurity. It is therefore recommended to define several equivalent profiles for a given qualification level.

For instance, the requirements for an auditor in a Module H assessment could be as follows:

• A Master degree in cybersecurity, plus two years of auditing practice as a junior auditor.
• A Master degree in a field related to cybersecurity 4 , plus four years of practice, including at least two years of auditing practice as a junior auditor.
• A Bachelor degree in cybersecurity, plus four years of practice, including at least two years of auditing practice as a junior auditor.
• A Bachelor degree in a field related to cybersecurity, plus six years of practice, including at least two years of auditing practice as a junior auditor.

Of course, the combinations depend on the role, but it is important to be flexible enough, in order to allow different career paths. In addition, these requirements should be adapted to local practices, and could be open to alternative paths, such as continuing education and other training opportunities.

On a different profile, the requirements for a penetration tester could be quite different (only one example provided, but variants should be considered in a way similar to those proposed for auditors above):

• A Master degree in computer science or electronics, evidence of training related to the use of specific equipment, plus on-the-job training in for at least one year on at least three relevant evaluations;

NOTE : This needs to be further discussed, but for the initial version of this document, and since the main reason for appointing notified bodies is to have them involved in the definition and implementation of initial rules, it seems interesting to focus on practical experience, both for the personnel and for the entity, requiring significant experience in the assessment of the cybersecurity of products with digital elements. In addition, education requirements could be replaced by personal certifications, and the definition of junior auditor need to be refined.

In addition, as indicated in Annex of CRA, in the case of Module H, at least one of the members of the auditing team needs to have experience “as an assessor in the relevant product field and product technology”.

NOTE : This requirement needs to be considered carefully, since it is quite strong, possibly stronger than for a product evaluator (since many of the competences are assigned to the evaluation team rather than an individual evaluator). It may be interesting to define a specific category for this specific role.

Europe Accreditation (EA) has issued document EA:2/17 [11] about accreditation for notification purposes, and they are regularly publishing updates for this project. Their 2025 update [9] mentions CRA, and the preferred standards that are proposed are:

• for Module B, “EN ISO/IEC 17065 + testing and inspection capability will be required”; and
• for Module H, “EN ISO/IEC 17021-1 + auditor competence must include specific product knowledge”.

In addition, EA 2/17 provides additional details in Annex B. For Module B:

• for testing, “fulfilment of the applicable requirements of clause 6 and 7 (except 7.9) in EN ISO/IEC 17025:2017 shall be demonstrated”; and
• for product knowledge, the requirement is the ability to make professional judgments related to product requirements, so “fulfilment of clauses 6.1.2, 6.1.3 and 6.1.6 to 6.1.10 of EN ISO/IEC 17020:2012 shall be demonstrated”.

And for Module H, only product knowledge applies, so the requirement is the ability to make professional judgments related to product requirements, so “fulfilment of clauses 6.1.2, 6.1.3 and 6.1.6 to 6.1.10 of EN ISO/IEC 17020:2012 shall be demonstrated”.

The present document only covers the competence requirements, but it is important to keep in mind that the actual requirement from EN ISO/IEC 17065 (in section 6.1.2) is about the “management of competence for personnel involved in the certification process”.

It is important to keep in mind that the availability of competent personnel is not only to be assessed at a point in time before accreditation or notification, but also that a process is in place to manage these competences over time. The operating effectiveness of this process also needs to be checked when the accreditation or notification is reviewed or renewed by a NA or NAB.