About dephensiva

Compliance, standardization and certification expertise, grounded in security engineering.

Javier TallónFounder and CEO

Who you will work with

Javier has spent about twenty years in security evaluation and certification. He worked as an evaluator in a Common Criteria laboratory, then co-founded and ran jtsec as technical director, an accredited evaluation laboratory that Applus+ acquired in 2022. He founded dephensiva in 2025 to work on the regulatory side, independently of any laboratory.

He is a computer engineer from the University of Granada, holds the OSCP and OSCE certifications, and has taught on the university's master's degree in cybersecurity since 2016.

Standards and certification work

National expert in ISO/IEC JTC 1/SC 27/WG 3 (security evaluation, testing and specification) since 2019.
Co-editor of ISO/IEC TS 9569:2023, the patch management extension for ISO/IEC 15408 and ISO/IEC 18045. ISO catalogue
Member of the ENISA ad hoc working group that prepared the EUCC scheme (2019 to 2024), where he led the task group on ISO/IEC 17025 and 17065 interpretation.
Member of the ENISA ad hoc working group on the EU scheme for managed security services (EUMSS) since 2025.
dephensiva joined ETSI as a full member in 2026 to work in the EUSR group of TC CYBER, which drafts most of the product-specific harmonised standards for the Cyber Resilience Act.
dephensiva is a member of the Spanish standardisation committee UNE CTN 320 (cybersecurity).
Speaker at the International Common Criteria Conference since 2009, and moderator of the methodologies panel at the ENISA Cybersecurity Certification Conference 2022. ICCC speakers ENISA conference programme
Regular working contact with certification authorities and experts from across Europe, including ANSSI and BSI, in ENISA, ISO and ETSI working groups.

Recent work

Evaluation methodology work for public-sector certification programmes, including the security evaluation of products that use artificial intelligence.
EU-funded expert review, within ETSI TC CYBER, of three draft harmonised standards for the Cyber Resilience Act (anti-malware, SIEM, and firewalls and intrusion detection): 37 comments submitted, 34 taken up by the drafting groups.

We do not publish client names or engagement details. Confidentiality is part of the service.

Our approach

We combine deep technical security expertise with fluency in regulatory frameworks and international standards. We are a boutique consultancy: senior, hands-on and small by design. The person you speak to is the person who does the work, and we come from security evaluation, so we understand how systems are attacked as well as how they are certified.

We help organisations at the intersection of the EU cybersecurity regulations (CSA, CRA, AI Act, NIS2 and DORA), with guidance that connects technical implementation and regulatory requirements.

Compliance today is interconnected. We look at how the regulations reinforce each other, and at how management system standards such as ISO/IEC 42001 help organise several obligations, without themselves giving a presumption of conformity.

Standards development

We contribute to European and international standardization through CEN/CENELEC technical committees, ETSI TC CYBER, ISO working groups and ENISA ad hoc working groups, including those for the EUCC scheme and the EUMSS candidate scheme. This keeps our guidance aligned with current technical work and regulatory interpretation.

CEN/CENELEC: Technical committees
ETSI: TC CYBER, EUSR group
ISO/IEC: Working groups
ENISA: Ad hoc working groups

Who we work with

Manufacturers whose products fall under EU regulation, government security agencies and certification scheme owners, and the operators and ICT providers that depend on certified products, in any EU Member State. Our relationships rest on technical credibility, regulatory accuracy and practical implementation guidance.

Independence

dephensiva owns no evaluation laboratory or certification body and does not evaluate or certify products. Neither dephensiva nor its founder holds shares in jtsec or Applus+, or has an earn-out with them. We declare any potential conflict of interest before an engagement starts.