Global Certifications

NCIIPC-QCI Conformity Assessment Framework for Cybersecurity of CSEs

The implementation, operation and management of cyber security in CSEs requires to be assessed by independent accredited Certification Bodies (CBs) and Inspection Bodies (IBs) for compliance with prescribed standards for the sectors. Further, the CSEs require competent cyber security professionals, who are assessed and certified by independent accredited Personnel Certification Bodies (PrCBs). The CSEs also require competent consultancy organisations (COs) and training bodies (TBs), whose expertise and competence is assessed and certified by independent Accreditation Bodies (ABs).

NCIIPC and Quality Council of India (QCI) have formulated and designed a comprehensive Scheme for “Conformity Assessment Framework for Cybersecurity of Critical Sector Entities”. The objective of the Scheme is to establish robust cybersecurity accreditation, certification and inspection processes for

• critical sector entities (CSEs)
• cybersecurity professionals
• consulting organisations (COs)
• training bodies (TBs)

The Scheme incorporates the international framework for accreditation of conformity assessment bodies, viz,  CBs, IBs and PrCBs, which is the most appropriate mechanism to ensure quality, integrity, consistency and standardisation.

The CAF for cyber security of CSEs comprises of the following Schemes:

• Certification Scheme for Cyber Security Management System (CSMS) at Levels 1,2 and 3.
• Inspection Scheme for Information Technology and Industrial Control Systems (IT/ICS).
• Personnel Certification Scheme for Cyber Security Professionals.
• Accreditation Scheme for IT/ICS Consultancy Organisations (COs).
• Accreditation Scheme for IT/ICS Training Bodies (TBs).

Details of the Scheme are available on NCIIPC and QCI websites.

The outcomes delivered by the Schemes are as under:

• Pool of accredited CBs & IBs: The Government, Regulators, NCIIPC, CSEs and other organisations will have a pool of accredited CBs and IBs for carrying out conformity assessment and/ or inspection of an organisation’s information infrastructure and information security/ cybersecurity management system (ISMS/ CSMS).

• Pool of accredited PrCBs and certified Cyber Security Professionals: All organisations will have an indigenous pool of certified cybersecurity professionals, who are assessed and certified by accredited PrCBs for their competence (knowledge, skills, expertise) to implement and ensure IT and OT cyber resilience. The competency certification of cybersecurity professionals is closely aligned with the workforce competency described here.

• Pool of accredited COs and TBs: All organisations will have an indigenous pool of accredited COs and TBs with independently certified expertise and competence, to provide them cybersecurity consultancy services and train their workforce. The COs and TBs themselves will leverage the established pool of CSPs for delivering their services.

The Scheme as a whole is adapted to the cybersecurity requirements of CSEs and other organisations of the Indian ecosystem. It is expected to contribute to building national capacity in the cybersecurity domain.

Global Certifications

An illustrative list of cybersecurity certifications offered by global certifying bodies has been compiled from publicly available information and is given below. It also gives a generic mapping of the certifications to the domains defined here. The list has not been vetted for correctness and completeness. Suggestions for improvements and rectification of errors are welcome.