Composite Inspection and Certification (CIC) System for Cybersecuity Assessment of ICT Products, Services, and Processes

Abstract—The Digital Business Ecosystem (DBE) is heavily relied on digital technology to create business opportunities and supports analyzing wide range of data that flows through the business ecosystem. However, interconnected ICT components including products, services and processes within DBE raises security challenges due to the vulnerabilities within the components and technologies used by these components are mostly from third party providers. Additionally, cyber-attacks propagate throughout the whole digital networks creating major outage or disruption in the daily business or services operations and triggering far-reaching cascading effects into other segments and outcomes. Cybersecurity certification scheme can play a significant role in ensuring the security and trust of ICT products, services and processes. However, the conformity assessment process is challenging because product level security depends on not only the security of individual product but also interactions among the components used in the product itself. This paper presents a novel Composite Inspection and Certification (CIC) System that dynamically assess the conformity of the product based on the Composite target of evaluation. CIC includes a number of key components and facilitates the assessors in building their capacity for the overall certification process. Keywords— Cybersecurity certification, composite target of evaluation, conformity assessment , dynamic risk assessment, ICT product