DataTerminology.comNEW
EU-wide framework defining cybersecurity certification schemes and assurance levels for ICT products, services, and processes.
DESCRIPTION
Established by the Cybersecurity Act, the EU framework harmonizes cybersecurity certification across Member States. Schemes specify scope, requirements, assurance levels (basic, substantial, high), and conformity assessment procedures. It reduces duplication of national certifications and fosters trust in the single market. Examples include EUCC for ICT products, EUCS for cloud services, and sector-focused schemes like EU5G. Public and private buyers can reference assurance levels in procurement. Over time, the framework aims to improve security baselines and comparability.
ALTERNATIVE DEFINITIONS
European Commission
The EU cybersecurity certification framework establishes EU-wide rules for the certification of ICT products, services and processes.
Defines scope and EU-wide harmonization of certification rules.
ENISA
The framework provides a mechanism to develop EU cybersecurity certification schemes with assurance levels basic, substantial and high.
Emphasizes assurance levels and scheme development.
RELATED TERMS
Cybersecurity Act EUCC EUCS EU5G Common Criteria ISO-IEC 27001 Conformity Assessment
COMPETING TERMS
Common Criteria (ISO/IEC 15408)
RELATIONS
- Broader: Framework
KNOWLEDGE AREAS
Data Security Data Governance Infrastructure
TARGET AUDIENCE
Chief Information Officer Chief Technology Officer Cloud Architect Data Architect Data Governance Manager
EXTERNAL SOURCES
- Wikipedia - EU Cybersecurity Certification Framework
- European Commission - Framework overview and schemes
- ENISA - Schemes and assurance levels
TOP QUESTIONS
What problems does the EU cybersecurity certification framework address?
It reduces fragmented national certifications by harmonizing rules and recognition across the EU, improving trust and market access.
Category: Overview
What are the assurance levels in EU schemes?
Basic, Substantial, and High. They reflect increasing rigor and confidence in security measures and evaluations.
Category: Definition
Are EU cybersecurity certifications mandatory?
Schemes are usually voluntary unless mandated by sectoral laws or procurement requirements. Market forces often encourage adoption.
Category: Policy
How do EU schemes relate to ISO/IEC 27001?
27001 certifies ISMS processes, while EU schemes certify specific ICT products or services at defined assurance levels. They can be complementary.
Category: Comparison
What is EUCS?
EUCS is the proposed EU cybersecurity certification scheme for cloud services, defining requirements and assurance levels tailored to cloud.
Category: Example
Who performs conformity assessment?
Accredited conformity assessment bodies, with involvement of national authorities for oversight. Self-assessment may be allowed at lower assurance.
Category: Process
How should buyers use certifications?
Reference assurance levels in procurement to align security requirements and compare offerings consistently across providers.
Category: Application
What is a common misconception about EU certification?
That a single certificate covers all services or levels. Certifications are scheme-specific with defined scope and assurance.
Category: Misunderstanding
How do schemes evolve over time?
They undergo updates to reflect new threats, technologies, and regulatory requirements, preserving relevance and assurance integrity.
Category: Lifecycle