Structure
The structure of the STIC Products and Services Catalogue (CPSTIC) is defined in the CCN-STIC 140 guide "Reference taxonomy for ICT security products". It is basically organised in three (3) lists:
Each of them is made up of several categories which, in turn, are made up of several families.
Qualified Products and Services
This list includes products and services that form part of the security architecture of ICT systems that are under the scope of the ENS in one of its BASIC, MEDIUM or HIGH categories, i.e. those that develop their activity in the operational context of the ENS and implement functionalities that increase the security level of the system in one of its dimensions (availability [D], integrity [I], confidentiality [C], authenticity [A] and traceability [T]).
For a product or service to be qualified, it must comply with the Fundamental Security Requirements (FSR) defined for each family, included in the corresponding annexes of the CCN-STIC 140 guide:
Access control
Operational safety
Security monitoring
Protection of communications
Protection of Information and Information Media
Protection of Equipment and Services
Cloud services
Cryptographic mechanisms
Protection of facilities and infrastructure
OT security
Security product development tools
Other tools
Approved Products and Services
The taxonomy of products approved for the handling of classified information shall be the same as for qualified products together with the following categories:
Protection in tactical environments
Tempest
The Fundamental Security Requirements (FSR) shall be the same as those set out in this guide for qualified products, updated with those specific to encryption products set out in CCN-STIC-130 Approval Requirements for Encryption Products for Handling Classified National Information.
Compliance and Governance Products and Services
The list of Compliance and Governance Products and Services includes products and services that are not part of the security architecture of an ICT system, but which implement functionalities that facilitate compliance with security regulations. This group includes, for example, auditing tools, risk analysis or system/equipment basing.
From the point of view of inclusion in the CPSTIC, no specific requirements have been defined for these products and no certifications are required, although they are assessed in an accredited laboratory.
This list has a single category, Compliance and Governance, which is composed of the following families:
CG.1
Security Governance and Planning
CG.2
Safety and Compliance Regulations
CG.3
Risk Analysis and Management
CG.4
Notification and Management of Cyber Incidents
CG.5
Cyber Intelligence Exchange
CG.6
Cybersecurity Awareness and Training
