EU Cybersecurity Act

Regulation (EU) 2019/881 - ENISA permanent mandate, European cybersecurity certification scheme.


Short name	EU CSA
Region	Europe
Country or scope	European Union
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers EU CSA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for EU CSA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for EU CSA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`EU-CSA-51-DEP` Documented Dependencies	Certification security objectives require that ICT products identify and document their known dependencies, which an SBOM satisfies through explicit dependency relationships (Regulation (EU) 2019/881 Art. 51(1))	Scan
`EU-CSA-51-INV` Component Enumeration	Documenting a product's dependencies and vulnerabilities presupposes an enumerated inventory of the software components it is built from (Regulation (EU) 2019/881 Art. 51(1))	Scan
`EU-CSA-51-VULN` Known-Vulnerability Traceability	The certification objective of identifying and documenting known vulnerabilities requires components to carry standard identifiers (PURL/CPE) so they can be matched against vulnerability databases (Regulation (EU) 2019/881 Art. 51(1))	Scan
`EU-CSA-51-UPD` Up-to-Date Software	Security objectives include products being provided with up-to-date software free of publicly known vulnerabilities, which requires each component's version to be recorded and assessable (Regulation (EU) 2019/881 Art. 51(1))	Scan
`EU-CSA-52-INTEG` Assurance-Level Integrity Evidence	Assurance levels substantial and high require evaluation that minimises known cyberattack risks, including assurance that delivered software is authentic and unmodified, supported by integrity hashes (Regulation (EU) 2019/881 Art. 52)	Scan
`EU-CSA-55-INFO` Supplementary Supplier Information	Manufacturers and providers must publish supplementary cybersecurity information such as support and vulnerability-handling details, which presumes the supplier of each component is identified (Regulation (EU) 2019/881 Art. 55)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CSA-Art46`	European Cybersecurity Certification Scheme: Establishment
`CSA-Art47`	Scheme Content Requirements
`CSA-Art48`	Assurance Levels
`CSA-Art49`	Self-Assessment of Conformity
`CSA-Art51`	Security Requirements for Certified Products
`CSA-Art52`	European Cybersecurity Certificate
`CSA-Art53`	Obligations of Holders
`CSA-Art54`	Accreditation of Conformity Assessment Bodies
`CSA-Art56`	ENISA Mandate: Cybersecurity Certification
`CSA-Art57`	ENISA Peer Reviews and Assistance

Policy templates

Written for EU CSA:

EU Cybersecurity Act Certification Policy

And 22 from the standard set, adapted to EU CSA.