Evaluation and approval of IT-security products

The required degree of confidence in the security measures, defined as a level of assurance, shall be determined following the outcome of the risk management process and in line with the relevant security policies and security guidelines. The level of assurance shall be verified by using internationally recognised or nationally approved processes and methodologies. This includes primarily evaluation, controls and auditing. Cryptographic products for protecting EUCI shall be evaluated and approved by a national CAA of a Member State. Prior to being recommended for approval by the Council or the Secretary-General in accordance with Article 10(6), such cryptographic products shall have undergone a successful second party evaluation by an Appropriately Qualified Authority (AQUA) of a Member State not involved in the design or manufacture of the equipment. The degree of detail required in a second party evaluation shall depend on the envisaged maximum classification level of EUCI to be protected by these products. The Council shall approve a security policy on the evaluation and approval of cryptographic products. Where warranted on specific operational grounds, the Council or the Secretary-General as appropriate may, upon recommendation by the Security Committee, waive the requirements under paragraphs 25 or 26 of this Annex and grant an interim approval for a specific period in accordance with the procedure laid down in Article 10(6). The Council, acting upon recommendation by the Security Committee, may accept the evaluation, selection and approval process of cryptographic products of a third State or international organisation and accordingly deem such cryptographic products approved for protecting EUCI released to that third state or international organisation. An AQUA shall be a CAA of a Member State that has been accredited on the basis of criteria laid down by the Council to undertake the second evaluation of cryptographic products for protecting EUCI. The Council shall approve a security policy on the qualification and approval of non-cryptographic IT security products.

← anx_IV__cpt_1__cpt_2__cpt_6__point_22__text_1 · All articles · 23. →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.