security certification framework proposal by end-2017. In this context, the Commission will also consider Regulation (EC) No 2008/765 and certification provisions included in the General Data Protection Regulation 2016/67929. The process will include a broad consultation and impact assessment. This will enable the Commission to explore various options for the creation of the certification framework for ICT products and services. The Commission will also explore ICT security certification within infrastructure sectors (e.g. in aviation, railways, automotive), and within specific certification and validation mechanisms of ready-to-be-deployed technology (e.g. Cybersecurity of Industrial Automation Control Systems30, Internet of Things, Cloud). It will also address identified gaps under the European ICT security certification scheme mentioned above. As much as possible, certification efforts will build on internationally recognised standards and be developed with international partners. The Commission will also explore options related to how best to integrate ICT security certification in future sector-specific legislation, also related to safety aspects. Apart from possible regulatory options, the Commission will also explore the creation of a European, commercially oriented, voluntary and lightweight labelling scheme for the security of ICT products. Complementary to certification, it will aim to increase the readability of cybersecurity in commercial products so as to increase their competitiveness in the single market and globally. Due consideration will be given to ongoing sectoral and horizontal initiatives launched by industry, from both the supply and demand sides. Public administrations will be closely involved to enable use of common specifications and reference to certification in public procurement. The Commission will also monitor and report on the usage of relevant certification requirements in public procurement, at national level, in particular for sectoral systems (energy, transport, health, public administration, etc.) The Commission will: - - Develop by end-2016 a Roadmap towards a possible European ICT security certification framework proposal, to be presented by end-2017, and to assess the feasibility and impact of a European lightweight cybersecurity labelling framework; explore the need and, if appropriate, address gaps in ICT security certification within existing sector-specific certification/validation mechanisms; include, where appropriate, the integration of ICT product security certification in future sector-specific legislative proposals; stimulate involvement of public administrations to facilitate the use of certification and common specifications in public procurement; and monitor the usage of relevant certification requirements in public and business 29 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, provides for both codes of conduct intended to contribute to the proper application of the data protection rules as well as for certification mechanisms covering all data protection principles, including in particular the data security of the personal data processing. 30 See ERNCIP’s Thematic group on “Cyber security of Industrial Control Systems”, available at https://erncipproject.jrc.ec.europa.eu/download-area/category/16-case-studies-for-industrial-automation-and-control-systems. 10