Go to content

Scheme Development

The CSA certification scheme development plans are laid out in the Union Rolling Work programme (URWP). The URWP is a strategic document under the Cybersecurity Act (CSA) that allows the industry, national authorities and standardisation bodies to prepare in advance for future European cybersecurity certification schemes.

The drafting of the URWP is a joint effort between the European Commission (EC), the European Cybersecurity Certification Group (ECCG) and the Stakeholder Cybersecurity Certification Group (SCCG). The European Commission determines and prioritizes the development of the CSA certification schemes for ICT products, services and processes. With the support of the Member States in the European Cybersecurity Certification Group and the Stakeholder Group, these priorities are discussed and included in the URWP. The URWP is updated at least every 3 years.

In duly justified cases the CSA authorizes the EC to decide on the development of certification schema outside the URWP priorities.

The table below shows the URWP priorities for European schemes and their current status.

Table with URWP's priorities for European schemes and their current status

Table with URWP's priorities for European schemes and their current status
Certification TypeOperational from (indication)Current status (see reference below table)
Common Criteria (EUCC)Hardware products, product-related softwareQ2 20245
Cloud Services (EUCS)Services in the whole stackQ4 20242
5G (EU5G)Components, component-related services, secure developmentNo indication yet2
Industrial Automated Control SystemsExpected: products, product-related servicesNo indication yetDevelopment not started
IoTExpected: products, Product-related servicesNo indication yetDevelopment not started
Artificial IntelligenceScope to be discussedNo indication yetDevelopment not started
Secure (Software) DevelopmentScope to be discussedNo indication yetMay be part of other schemes
Source table as .csv (732 bytes)

Scheme Development Process (current status reference)

The development of schemes follows a distinctive process with the following main milestones:

  1. The European Commission assigns ENISA to develop a scheme.
  2. ENISA makes a public call for experts in the field and scope of the scheme and asks Member States to join the development in the role of observer.
  3. ENISA delivers a final draft to the EC.
  4. The ECCG advises the European Commission (EC) on the final draft of the scheme.
  5. The EC transforms the final draft in an Implementing Act and follows the formal EU legislative procedures.
  6. The EC publishes the Implementing Act, and the scheme is put into force.