Search

This deliverable’s objective is to report the results of the activities performed in the first phase of CYRENE’s Work Package 3. Its main output is to present the proposal of an enhanced Risk and Conformity Assessment (RCA) methodology that combines all the relative standards, policy and legal requirements mentioned in the deliverable 2.1. This RCA methodology is an enhanced method of dual use, as it should be able to be used by: SCS Providers and Business Partners to help them get prepared for a certification, and assessors in order to demonstrate the validity of the claims, for example, in a Protection Profile. In this document every step of the CYRENE RCA methodology is analysed in a form of scope, input and expected outcome, followed by an example for better comprehension of the reader. In addition, eight appendices are included in the current document.

Supply Chain Services (SCS) are the backbone of any economy and their security is most important for the competitiveness, prosperity and resilience of the European Digital Single Market. Security certification of the SCS is the necessary mitigation measure towards the trustworthiness of the digital economies. This paper presents the building blocks and requirements for the certification of the SCS.

The objective of this deliverable is to report the results of the activities performed in the first phase of CYRENE’s Work Package 2. The main output is related to the requirements that have been collected from relevant standards and literature review, project pilot partners, as well as external stakeholders. The document can be divided in four main parts. In the first one, an overview of the Supply Chains is given, describing both their classification, including three different views (business, technical and sectorial) of the SCs, and their security aspects, consisting of the threat landscape, legal framework, SC security and Risk Management standards and SC risk assessment methodology and tools. In the second part, an overview of the EU Certification schemes is provided, encompassing the general definition and requirements (policy, legal, standards, methodologies, technical) regarding the security certification. Moreover, in the third part, the document reports on the methodology used for collecting, analyzing and validating the requirements through the project’s Advisory Boards. The feedback obtained from the proposed questionnaire for requirements validation are presented in this part and conclusions are drawn afterwards. Finally, the fourth part of the deliverable deals with the three Targets of Evaluation (ToEs), namely, the Business, Technical, and Sectorial. Their descriptions and the respective validated requirements are provided in this section. Two appendixes are included in the document. The first one gives information on a glossary that forms the basis of the concepts used in the project, while the second one gives details regarding the first workshop organized with the Advisory Boards at the end of the first six months of the project.

The objective of this deliverable is to report the results of the activities performed in the first phase of CYRENE’s Work Package 2. The main output is to propose a draft version of the EUSCS candidate scheme (European Cybersecurity Certification Scheme for Supply Chain Services), which looks into the certification of the cybersecurity of supply chain services. In this document all the elements of European cybersecurity certification schemes as defined in the Article 54 of the EUCSA are presented. Eight appendices are also included in the document. The proposed SCS serves as guidelines to the SCS auditors; it specifies the various views of the SCS that can be adopted; the cybersecurity requirements that need to be met -such as standards or technical specifications-, the type of evaluation that is planned to be - done such as self-assessment or third party - and the intended level of assurance that is going to be achieved.