We help national authorities, scheme owners, industry associations and certification bodies build certification schemes that evaluators can apply consistently and that fit the European framework. We evaluate no products and issue no certificates, so we have no stake in who applies the scheme.
For
You receive
The Cybersecurity Act (Regulation (EU) 2019/881) sets up the European cybersecurity certification framework. ENISA prepares candidate European schemes with an ad hoc working group for each, and the Commission adopts them by implementing act (Article 49). Article 54 lists what a European scheme must contain, from scope and assurance levels to evaluation criteria and methods, monitoring of compliance, handling of newly found vulnerabilities and certificate validity. Article 52 defines three assurance levels, 'basic', 'substantial' and 'high', each with minimum evaluation activities, and lets a scheme define evaluation levels within them. EUCC (Implementing Regulation (EU) 2024/482) is the adopted scheme for ICT products: it is based on the Common Criteria and the Common Evaluation Methodology (ISO/IEC 15408 and ISO/IEC 18045), issues certificates at 'substantial' and 'high', and allows protection profiles to be certified for a product category. For a national or private scheme, Article 54 is also a sound checklist of what the rules must answer.
In the Act's terms, a national cybersecurity certification scheme is one developed and adopted by a national public authority (Article 2, point 10). When a European scheme covers a category of ICT products, services, processes or managed security services, national schemes for that category cease to produce effects from the date set in the implementing act (Article 57(1)), and certificates already issued remain valid until they expire (Article 57(3)). Member States may not introduce new national schemes for categories covered by a European scheme in force (Article 57(2)), and must inform the Commission and the European Cybersecurity Certification Group of any intention to draw up a new one (Article 57(4)). A national scheme therefore has to be scoped against the European schemes in force and those in preparation, and designed with a transition path.
The evaluation methodology decides whether a scheme works in practice. ISO/IEC 15408 and ISO/IEC 18045 suit higher assurance and certification against protection profiles. EN 17640, Fixed-time cybersecurity evaluation methodology for ICT products (often called FITCEM), developed by CEN-CLC/JTC 13, evaluates a product within a time frame set at the start and is designed for use at the three assurance levels of the Act. Conformity assessment bodies are accredited by national accreditation bodies and must meet the requirements in the Annex to the Act (Article 60(1)), including independence from what they assess and a ban on activities, consultancy in particular, that may conflict with their independence of judgement. Under EUCC, certification bodies are expected to be accredited against ISO/IEC 17065 and evaluation facilities (ITSEFs) against ISO/IEC 17025, complemented by ISO/IEC 23532-1. dephensiva owns no laboratory or certification body and evaluates no products, so we can write rules, methods and competence requirements without a commercial interest in who will apply them.
Scope, intended users and assurance needs, overlap with European schemes in force and in preparation, choice of assurance levels and evaluation approach, governance options for the owner, and a recommended scheme architecture.
Typical duration: 6 to 10 weeks
Rules structured on the elements of Article 54 of the Cybersecurity Act: scope, roles, application and evaluation process, certificate content and validity, maintenance and surveillance, vulnerability handling, marks, complaints and appeals, and the governance of the scheme itself.
Typical duration: 10 to 16 weeks
A protection profile under ISO/IEC 15408 for a product category, or a security requirements catalogue for schemes not based on Common Criteria, with the threat model and the rationale that links threats, objectives and requirements.
Typical duration: 8 to 14 weeks
A methodology based on ISO/IEC 18045 or EN 17640 and adapted to the scheme: evaluation tasks, time budgets, testing expectations, attack potential rating, report templates, and the interpretation notes that evaluators and certifiers need to reach consistent verdicts.
Typical duration: 10 to 16 weeks
Support for the scheme owner while laboratories run pilot evaluations: follow-up of the pilots, a log of interpretation issues, training for evaluators and certifiers, and revision of the rules and methodology from the results. We do not perform the evaluations.
Typical duration: 3 to 6 months
Competence and accreditation requirements for certification bodies (ISO/IEC 17065) and laboratories (ISO/IEC 17025), points of coordination with the national accreditation body, and, for national schemes, the path to follow if a European scheme comes to cover the same category.
Typical duration: 4 to 8 weeks
Yes, for categories that no European scheme in force covers. Article 57(2) of the Cybersecurity Act prohibits new national schemes only for ICT products, services, processes or managed security services already covered by a European scheme in force, and Article 57(4) requires the Member State to inform the Commission and the European Cybersecurity Certification Group of its intention to draw one up. National schemes for categories outside European schemes continue to exist (Article 57(1)).
It ceases to produce effects for the covered products from the date set in the implementing act that adopts the European scheme (Article 57(1)). Certificates already issued under it remain valid until they expire (Article 57(3)). For EUCC, that date was set at twelve months after the implementing regulation entered into force (Article 49 of Implementing Regulation (EU) 2024/482). We design national schemes with this transition in mind from the start.
EN 17640, Fixed-time cybersecurity evaluation methodology for ICT products, is a CEN and CENELEC standard for evaluating an ICT product within a time frame fixed at the start of the evaluation. It is designed for use at the basic, substantial and high assurance levels of the Cybersecurity Act. It suits schemes where predictable duration and cost matter more than the full documentation analysis of the Common Criteria. Where a scheme relies on protection profiles or on high attack potential, ISO/IEC 15408 and ISO/IEC 18045 are usually the better base.
Public authorities, user communities, industry associations or manufacturers can sponsor one; what matters is that it states the security needs of a product category independently of any one implementation. Under EUCC, a protection profile can be evaluated and certified in its own right, for the sole purpose of certifying ICT products of the category it covers (Article 5(2) of Implementing Regulation (EU) 2024/482). We draft protection profiles; their evaluation is done by an evaluation facility and their certification by a certification body.
Article 52 of the Cybersecurity Act sets the minimum. 'Basic' requires at least a review of technical documentation. 'Substantial' requires a review for publicly known vulnerabilities and testing that the security functions are correctly implemented. 'High' adds testing at the state of the art and penetration testing to assess resistance to skilled attackers. Substitute activities with equivalent effect are allowed where these are not appropriate, and a scheme may define several evaluation levels within each assurance level (Article 52(8)). Under EUCC, 'substantial' corresponds to AVA_VAN levels 1 and 2, and 'high' to AVA_VAN levels 3 to 5.
Because the scheme owner needs advice that does not favour any party that will apply the scheme. dephensiva owns no laboratory and no certification body, evaluates no products and issues no certificates. Neither dephensiva nor its founder holds shares in jtsec or Applus+, and we declare any potential conflict of interest before an engagement starts. We take part in CEN/CENELEC technical committees, ETSI, ISO working groups and ENISA ad hoc working groups, including those for the EUCC scheme and the EUMSS candidate scheme, where we work regularly with certification authorities from across Europe, and we work for both governmental and private scheme owners.