FAQ CPSTIC

The CPSTIC (ICT Security Products and Services Catalog) is an initiative of the National Cryptologic Center (CCN) aimed at ensuring that ICT products and services used in systems of Public Administrations and entities of strategic interest comply with the security requirements of the National Security Scheme (ENS).

The main objective of the CPSTIC is to facilitate organizations in the selection of products and services that have demonstrated an adequate level of security, thus contributing to better protection of information systems against threats and cyberattacks.

The CPSTIC is structured into three main lists:

• Qualified: Products and services evaluated in accordance with the CCN requirements, suitable for systems subject to the National Security Scheme (ENS) at BASIC, MEDIUM, or HIGH levels.
• Approved: Solutions designed for the management of Classified Information, expressly evaluated and approved by the CCN.
• Compliance and Governance: Products and services that support regulatory compliance, without being a direct part of the system's security architecture.

Interested manufacturers and suppliers must submit an application to the CCN and comply with the technical and evaluation requirements established in current regulations. These requirements are detailed in the guides and documentation published on the CPSTIC portal.

No. The CPSTIC does not replace certifications such as Common Criteria or LINCE, but rather complements them. Inclusion in the CPSTIC implies that the product or service has been evaluated according to additional criteria established by the CCN and appropriate to the national context.

In the "About CPSTIC" section, click on "Contact" to find all the information to get in touch with us.

The CPSTIC facilitates the acquisition of reliable security products and services by public administration agencies or private entities that provide services to them for deployment in ICT systems under the National Security Scheme (ENS) or systems that handle Classified Information.