IDS certification scheme

Any organization or individual seeking permission to operate components in the International Data Spaces needs to pass the Operational Environment Certification which ensures secure processes and management of components.

Comparably, each IDS component is expected to behave in adherence with IDS specifications and to protect the data which is transferred and processed. It shall allow participants to assess the possible consequences of data sharing and provide transparent information. Therefore, components need to pass the Component Certification before they may be used in the IDS.

While the certification of organizations and individuals focuses on security and trust, the certification of components additionally refers to compliance with technical requirements ensuring interoperability.
To ensure a consistent process in the certification of participants and core components, the IDS uses a certification scheme comprising all processes, rules, and standards governing the certification process. The IDS Certification Scheme follows best practices from internationally recognized certification concepts.

[Download not found]

Roles in IDS Certification

• applicants,
• evaluation facilities, and
• certification body

Certification body

The certification body oversees the certification process regarding quality assurance and framework governance. It defines standard evaluation procedures and supervises the actions of the evaluation facilities. A certificate is granted only if both, the evaluation facility, and the certification body have concluded that all preconditions for certification are fulfilled.

Evaluation facility

Contracted by an applicant, the evaluation facility is responsible for carrying out the detailed technical and/or organizational evaluation work during a certification process. The evaluation facility issues an evaluation report for the respective organization/individual or core component, listing details regarding the evaluation process and an assessment whether all requirements are properly fulfilled.

The approval scheme for evaluation facilities can be found here.

Applicant

The applicant is not just the subject of the evaluation and certification process but plays an active part in it. An applicant needs to actively apply to trigger the certification process. During the certification process, the Applicant provides all necessary material needed for the evaluation and certification of its component or organization and supports with questions or issues arising.

Certification process

• Application Phase: The main goal of this stage is the successful start of the IDS evaluation and certification process.
• Evaluation Phase: The main goal of this stage is the evaluation of an applicant or core component based on the defined evaluation criteria.
• Certification Phase: The main goal of this stage is the examination of the evaluation report by the certification body, which issues a certificate if the result of the evaluation process is positive.

Assurance Level 1

For Assurance Level 1, the applicant must apply directly to the certification body to trigger the start of the certification process.

Once the certification body accepts the application, the applicant is responsible for the evaluation phase by conducting a self-assessment and providing the results to the certification body. In the certification phase, the certification body reviews the self-assessment and issues the certificate, if the self-assessment meets the defined requirements.

Fig.: Certification Process for Assurance Level 1

Assurance Level 2 and 3

Assurance Level 2 and 3 require an independent evaluation facility to conduct the evaluation of the component or operational environment. The applicant must contract an evaluation facility. Together, applicant and evaluation facility finalize the application for certification with the certification body.

Afterwards, the evaluation facility is responsible for carrying out the evaluation according to the IDS certification scheme. The evaluation facility documents their progress and findings in an evaluation report which is passed on to the certification body at the end of the evaluation phase.

In the certification phase, the certification body examines the evaluation report and issues a certificate, if the evaluation was conducted properly and led to a positive evaluation result.