CYBERSECURITY STRATEGY OF THE REPUBLIC OF POLAND CYBERSECURITY STRATEGY OF THE REPUBLIC OF POLAND 6.3 Security tests and audits An important element of ensuring a quality assurance in the supply chain is the evaluation and certification of products (software, hardware and services in particular). The priority in this regard shall be to establish, and subsequently maintain and develop, a national s cybersecurity evaluation and certification scheme based on operations of accredited conformity assessment bodies, which shall enable the Republic of Poland to achieve full and internationally recognised status of an Authorizing Member country in providing cybersecurity solutions. Periodic audits are among measures that enable assessment of the effectiveness of the currently implemented information security management systems and the adequacy of the safeguards introduced. Audit methodologies should take into account applicable standards, good practices and specificity of respective sectors. The aim of such an approach is to achieve comparability of audit outcomes. Periodic tests (including penetration testing), which provide for a real assessment of the system’s resilience to threats, are another security assessment measure. Outcomes of these tests are the basis for verification of the safeguards deployed. In order to utilise the public capacity in the area of cybersecurity, the so-called bug-bounty8 testing shall be disseminated. The Republic of Poland shall actively participate in the work on establishing European cybersecurity certification schemes in accordance with Regulation (EU) No. 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No. 526/2013 (Cybersecurity Act). Actions at the national level shall include, in particular, designation of the national cybersecurity certification authority which shall issue European cybersecurity certificates, supervise national conformity assessment bodies which assess compliance of products, services and processes with the requirements set forth in the European cybersecurity certification schemes and cooperate with the national accreditation body – the Polish Centre for Accreditation in order to monitor and supervise activities of accredited national conformity assessment bodies which assess compliance with respect to the requirements of Regulation (EU) No. 2019/881 of the European Parliament and of the Council. These actions shall result in achieving, at the national level, the ability to support Polish manufacturers which, when holding European cybersecurity certificates, will be able to compete more efficiently on the of the European Union’s Digital Single Market. 8 20 Bug-bounty – search for software vulnerabilities conducted by people not associated with the software developer, usually with the general consent of the developer. 21