N AT I O N A L C Y B E R S E C U R I T Y ST R AT E GY I V III.3 DEVELOPMENT OF CERTIFICATION, TESTING AND STANDARDISATION METHODOLOGIES ICT processes that are established on the national territory, and which carry out conformity self-assessments. • The Luxembourg Institute for Standardisation, Accreditation, Safety and Quality of Products and Services (ILNAS) has been appointed as the National Cybersecurity Certification 1 Authority (NCCA) in Luxembourg within the framework of Regulation (EU) 2019/881 on Cybersecurity (“Cybersecurity Act – CSA”). In this context, the ILNAS will be in charge of supervision and will ensure that the rules relating to cybersecurity certification schemes, for the purpose of monitoring that ICT products, ICT services and ICT processes comply with the requirements of the European cybersecurity certificates issued on the national territory. Where appropriate, the ILNAS will also be responsible for monitoring compliance with the obligations of manufacturers or suppliers of ICT products, ICT services or • Depending on the identified national needs, the government may decide to appoint another national cybersecurity certification authority to carry out the certification tasks and/or tasks directly related to this. • The ILNAS takes part in various meetings of the European Cybersecurity Certification Group established in 2018 by the EU Cybersecurity Act to take into account any information relevant to its supervisory tasks. Levels of insurance A European cybersecurity certification scheme may specify one or more of the following levels of insurance for ICT products, ICT services and ICT processes: “basic”, “substantial” or “high”. The level of insurance corresponds to the level of risk associated with the intended use of the ICT product, ICT service or ICT process, in terms of the likelihood and impact of an incident. 1 Self-assessment A European cybersecurity certification scheme can allow conformity self-assessments to be carried out under the sole responsibility of the manufacturer or supplier of ICT products, ICT services or ICT processes. Conformity self-assessments are only permitted for ICT products, ICT services and ICT processes that present a low risk, a scheme corresponding to the so-called “basic” level of insurance. The manufacturer or supplier of ICT products, ICT services or ICT processes shall keep at the disposal of ILNAS the European Union declaration of conformity, the technical documentation and all other relevant information relating to the conformity of the ICT products or ICT services with the European certification scheme concerned for the period specified in the scheme. Certification For basic or substantial levels of assurance, certification is carried out by a conformity assessment body (CAB), unless a scheme provides that only a public body may issue certificates in duly justified cases (Art. 56.5). CASES, the department of SECURITYMADEIN.LU, the mission of which is to secure SMEs, will serve as the CAB for the elementary level. 18