The lists of ICT Products in Spain

One way to make an ICT product or system stand out from the competitors is to prove its ability to handle information in a cyber-secure manner, and for that, the most recommendable way is that a third party certifies the product according to a cybersecurity standard.

In Spain, the National Cryptographic Centre (CCN, for its acronym in Spanish) is the assigned body to issue the approval of cybersecurity in different standards. In the CCN we can find, among others, the following differentiated parts: the Certification Body (OC) and the CIS Products Catalogue (CPSTIC).

What is the Certification Body and what functions does it perform?

On the one hand, we have the Spanish Certification Body, which after the evaluation technical report of an accredited laboratory like jtsec, issues a certificate ensuring that a product meets the security requirements of a standard (LINCE, Common Criteria, ISO15408/ISO18045, etc...) according to a the specification. These the specification is detailed in the Security Target document. The Security Target document must be public to help the consumer to know exactly what has been tested and the methodology used

The Spanish Certification Body publishes certified products in a List of Certified Products, which is divided into 50 categories and emits Common Criteria certificates since 2007

It is important to note that there are Certification Bodies in many countries that perform this same task and there are mutual recognition agreements so that, if a product is certified in Spain, you can enforce its certificate in other countries and vice versa. For more information, you can check the list of all Common Criteria products.

The Security Target document is published in the List of Certified Products. The publication is mandatory unless it is a classified product, but if the product is certified outside Spain, we must check to the Common Criteria website.

CIS Products Catalogue (CPSTIC)

On the other hand, we have a most recent office of CCN, it is the CIS Products Catalogue (CPSTIC), which publishes a List of ICT Security Products since 2018. The CPSTIC ultimate object is that those responsible for procurement do not have to review the Security Target of each product to verify if it is suitable for their needs, so the CPSTIC team is involved in the approval of the Security Target document of the products. It should be noted that if a product is going to handle classified information or is going to be acquired and used by public bodies or private companies that are under theNational Security Scheme (ENS), it needs to be included in the CIS Products Catalogue (CPSTIC).

The CIS Products Catalogue (CPSTIC) also updates and monitors that the products included in the Lists maintain their security features despite the new threats that are emerging.

The CIS Products Catalogue (CPSTIC) handles two lists:

-The List of Qualified Products: Compiles the products that can be used for sensitive information under the National Security Scheme (ENS). Products on this list with a "HIGH" classification may be used in systems of any category, but products with a "MEDIUM" classification cannot be used in systems classified as ENS HIGH category, but it can be used in MEDIUM and BASIC.

In this list, products are divided into categories (note that the categories of the CPSTIC lists are not aligned with the categories of the certified product list) and families according to thereference taxonomiesthat can be found in theCCN-STIC 140 Guide.

For each category, the products shall fulfil a set of Fundamental Security Requirements (RFS) published as annexes. You can check the updated requirements for each category here.

Sometimes the certificate issued for a product may not cover all the RFS of the applicable annex, so the CCN may require deep justifications or complementary tests to be performed by an accredited laboratory.

You can find here the List of Qualified Products

- List of Approved Products: :if a product handles classified national information or information owned by other countries or international organizations (such as NATO or the European Union) this list is where it must be published. The Approved Products are classified into the categories of: Access Control, Exploitation Security, Communications Protection, Safety Monitoring, Information and Information Media Protection, Equipment and Services Protection, and Secure Tactical Communications

You can find here the List of Approved Products

The product or system must have a cybersecurity certification to enter in the List of Qualified Products or the List of Approved Products. CCN requires LINCE certification for medium or low category products and Common Criteria certification for the high category.

LINCEis a lightweight and practical certification, suitable for any company, also for small companies that want to promote their first products, or for Spanish subsidiaries of multinationals. jtsec is the first laboratory accredited by ENAC and CCN to evaluate the security of ICT products according to the LINCE methodology.

When a product is included in the CIS Products Catalogue (CPSTIC), it is required to submit within 6 months (in the case of Qualified Products) or immediately (in the case of Approved Products) a Safe Use and Secure Configuration Procedure, which will be published on the CPSTIC website.

jtsec clients that have their products included in the CIS Products Catalogue (CPSTIC)