4
ASSESSMENT TIER #2 – LIFECYCLE REQUIREMENTS
4.1
OBJECTIVE
4.1.1 The objective of this activity is to ensure that the developer adopts a
“Security-by-Design” approach and implements adequate processes and
practices to design, create, and maintain security in the Internet-Connected
Device.
4.1.2 Assessment Tier 2 is based solely on declaration of conformance by
the developer.
4.1.3 Devices that complete Assessment Tier 2 would entail that the developer
has taken steps to identify the threats commonly associated with such
devices and have implemented security measures against common threats
for Tier 2.
4.2
REQUIREMENTS
4.2.1 Assessment Tier 2 references the lifecycle security considerations of the
IMDA IoT Cyber Security Guide [2] published by the Info-communications
Media Development Authority (IMDA).
4.2.2 The developer is required to fulfil all 9 lifecycle provisions (CK-LP-01 to CKLP-09) listed in Chapter 7 – Conformance Checklist of this document.
4.3
DECLARATION OF CONFORMANCE
4.3.1 For all device categories, the developer shall complete and submit the
Conformance Checklist found in Chapter 7 – Checklist of this document to
CCC to declare conformance to lifecycle requirements.
4.3.2 The developer shall provide adequate supporting evidences alongside the
Conformance Checklist (e.g. detailed descriptions, screenshots, process
charts, work instructions, etc.) such that CCC is able to assess if the
requirements for Tier 2 have been met, and that the security lifecycle
processes and practices are adopted. Some examples of the expected
supporting evidences are listed in the checklist.
4.4
ACCEPTANCE CRITERIA
4.4.1 No independent testing nor an audit by the testing laboratory is required
for Assessment Tier #2.
4.4.2 However, CCC will review the submitted Conformance Checklist and
supporting evidences. Assessment Tier #2 is only considered satisfied
when CCC gains assurance through the submitted supporting evidences
that the developer has implemented the required processes and practices
and utilises them throughout the lifecycle of the DUT.
CLS Publication #2 | Page 8 of 49