Your situation
You are a manufacturer and want to demonstrate the security of your IT product – without lengthy preparation? The Accelerated Security Certification (BSZ) offers you a clear, practical and lean approach.
Free of charge and without obligation.
Your situation
Your customers ask for independent security evidence for your IT product. A Common Criteria certification, however, requires a number of specific manufacturer documents and corresponding lead time. What you need is a procedure that works with the product itself and still ends with a certificate from the BSI.
The Accelerated Security Certification (BSZ) of the BSI aims to keep the effort for the manufacturer to a minimum. All that is needed is the product and a Security Target. In short, the BSZ is a high-quality product penetration test: it checks whether your product is free of security flaws. After the application, testing takes about two to three months.
Our BSI evaluation facility has been recognised for BSZ evaluations since 1 December 2022. It combines the experience of an evaluation facility recognised by the BSI since 1992 with our BSI-certified penetration testing team. Whether BSZ, Common Criteria or another form of evidence fits your product, we clarify in our consulting for product manufacturers.
Services & results
You enter a lean BSI procedure with your product and a Security Target: the evaluation covers conformity with the Security Target, robustness by means of penetration testing and the implemented cryptography. After the application, testing takes about two to three months. A pre-evaluation shows you beforehand where your product stands; our evaluation facility has been recognised for the BSZ since 1 December 2022.
The BSZ focuses on the technical security robustness of the product. The BSI decides on the result; our task as the evaluation facility is a robust, traceable evaluation.
The basis of the BSZ is the Security Target, which describes the security properties to be evaluated and usually has to be written first.
Before the actual procedure, we offer a pre-evaluation of your product. It makes the certification procedure easier and reduces risks in the process.
After the application, we carry out the tests over a period of about two to three months. As a BSZ evaluation facility, we evaluate, among other things:
The BSI makes the final decision on whether the evaluation was successful. If the result is positive, the BSI issues the certificate.
BSZ certificate from the BSI
If the result is positive, the manufacturer receives the certificate.
With the certificate, you as the manufacturer commit to continue monitoring the product for new vulnerabilities and to provide updates.
Since 1 December 2022, our BSI evaluation facility has been officially recognised for evaluations under the Accelerated Security Certification. The evaluation facility itself has been recognised by the BSI since 1992; we have been evaluating IT products in cooperation with the BSI since 1991.
For the BSZ, the quality of the penetration tests is what counts most. Product Security therefore works closely with our penetration testing business unit, which the BSI has certified as an IT security service provider for IS penetration testing since 2013. We also use the experience from black-box product evaluations for component evaluations according to IEC 62443-4-2.
The head of our evaluation facility, Sebastian Fritsch, also explains how BSZ, Common Criteria and IEC 62443 relate to each other in the training course “Rechtskonform: IT-Produkte prüfen und zertifizieren” (in German) at heise conferences.
Getting started
Describe the security functions, product status and planned use. We clarify which documents and access are available for the BSZ evaluation and whether a technical pre-evaluation before the procedure makes sense.
A free technical workshop offers room for questions about the product evaluation and your manufacturer contributions. In particular, we discuss the preparation of the Security Target and the roles of the evaluation facility and the BSI.
The manufacturer commits to continue monitoring the product for new vulnerabilities afterwards and to provide updates.
The essential basis is the product and the Security Target. The installation guide is also evaluated. Which further manufacturer documents, access and prerequisites your procedure requires is clarified for the specific product.
A pre-evaluation examines the product before the certification procedure. It can reveal technical or documentation gaps that your team still needs to address. This reduces risks later in the process; it does not promise a certificate.
The BSI decides on the success of the evaluation and on certification. As the manufacturer, you commit to continue monitoring the product for new vulnerabilities and to provide updates. This product maintenance remains a separate task.
After the application, we carry out the tests over a period of about two to three months. A pre-evaluation before the procedure can reveal open points early and reduce risks in the process.
The BSZ is a penetration-test-driven security analysis overseen by the BSI; it essentially requires the product and a Security Target. Common Criteria is the internationally standardised evaluation standard (ISO/IEC 15408), whose certificates are accepted across Europe and worldwide, and requires more extensive manufacturer documents. We discuss which route fits in the free workshop.
Sicherheit schafft Vertrauen – für Sie und für Ihre Kunden. Wir bieten seit mehr als 30 Jahren die Prüfung von IT-Produkten in Zusammenarbeit mit dem BSI an. Seit dem 01.12.2022 ist unsere BSI-Prüfstelle nun auch …
Unser Leiter der Prüfstelle Sebastian Fritsch und unser Geschäftsführer Tobias Glemser haben einen Artikel für das heise Magazin iX zum Thema sichere IT-Produkte und Zertifizierungen geschrieben. In der aktuellen …
Im Rahmen der heise Academy findet ein weiterer Cybersecurity-Workshop mit einem Referent aus unserem Hause statt. Diesmal wird Sie unser Leiter der Prüfstelle, Sebastian Fritsch, durch den Workshop „Rechtskonform: …
