Bolstering Up Smart Products Cybersecurity (Re-)Certification with Manufacturer's Evidence

The innovation brought by smart connected products is transforming many of today's interactions tightly interconnecting physical and digital worlds. Such cyber-physical ecosystems blend data collected in the real world through sensors, with embedded processing, software, and connectivity to reaction (performed autonomously or in concert with the human) in the physical world. Recognizing the widespread adoption of digital elements in many aspects of everyday life along with a ramp up in incidents, recent regulations aim at accelerating on the adoption of good cybersecurity practices. These have the power to protect not only users of individual products but the entire ecosystem and the supply chain throughout all the stages of the lifecycle. A key aspect concerns the cybersecurity certification and how to ensure that the product remains secure once in use or it is re-certified when needed. In the following, we introduce a methodology to support a continuous (re-)certification process by means of evidence already generated by the manufacturer to ensure that product cybersecurity is maintained during operations.