August 6, 2021

ANSI National Accreditation Board Comments

Workshop on Cybersecurity Labeling Programs for Consumers:

Internet of Things (IoT) Devices and Software

The ANSI National Accreditation Board (ANAB) is a non-governmental organization that provides

accreditation services and training to public- and private-sector organizations, serving the global

marketplace. ANAB is the largest accreditation body in North America and provides services in more than

75 countries.

Conformity assessment is defined as a “demonstration that specified requirements relating to a product,

process, system, person or body are fulfilled.” The activities applied in today's marketplace include

certification, inspection, registration, supplier's declaration, testing, and the one dimension in which ANAB

is directly engaged: accreditation.

Ultimately, the marketplace and customers of conformity assessment services measure the beneficial value

of accreditation. For most suppliers, the primary benefit of accredited third-party certification is to meet a

purchaser's or regulator's requirement for this independent evaluation of compliance. Increasingly,

suppliers' procurement organizations are specifying and government agencies are recognizing accredited,

third-party certification as an optional dimension of their systems for risk management.

ISO CASCO, Conformity Assessment Tools to Support Public Policy. See: ISO CASCO Toolbox.

ISO/IEC 17020, Conformity assessment — Requirements for the operation of various types of bodies

performing inspection

ISO/IEC 17021- 1, Conformity assessment — Requirements for bodies providing audit and certification of

management systems – Part 1: Requirements

ISO/IEC 17025, General requirements for the competence of testing and calibration laboratories

ISO/IEC 17030, Conformity assessment — General requirements for third-party marks of conformity

ISO/IEC 17065, Conformity assessment — Requirements for bodies certifying products, process and

services

The U.S. government increasingly relies on ANAB accreditation for the verification of the quality of

certification programs. In view of the numerous certification programs and the necessity to assist the

consumer in making informed decisions, government entities look to ANAB to provide accreditation

1
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

programs that improve industry practices and distinguish quality certification programs.

ANAB conducted a survey in 2020 to help determine the need for accreditation of Cybersecurity testing and

certification schemes. Recommendations from the survey are as follows:

 Set up an industry advisory group on cybersecurity conformity assessment to provide guidance, and

alleviate widespread confusion in the marketplace;

 Provide educational opportunities to reduce misunderstanding of cybersecurity conformity

assessment approaches and terminology – e.g., accreditation vs certification, etc.;

 Support a NIST cybersecurity workshop. During an interview, NIST itself opined that a

cybersecurity workshop would be timely and indicated their willingness to sponsor it; and.

 Form an ANAB Accreditation Committee Task Force to assist in establishing an ANAB

accreditation program for cybersecurity schemes.

ANAB is in the process of acting on these recommendations and is forming a task force that will be

responsible to review the conformity assessment trends on related to cybersecurity and support ANAB on

the design of a robust accreditation program based on the ISO/IEC 17065 and best practices in this sector.

As stated in the Workshop invitation, “the President on May 12, 2021, issued an Executive Order on

Improving the Nation’s Cybersecurity (EO 14028). Among other things, Section 4 of the EO directs NIST

to initiate two labeling efforts – informed by existing consumer product labeling programs – to educate the

public on the cybersecurity capabilities of Internet-of-Things (IoT) devices and software development

practices.”

With regards to how different conformity assessment approaches (e.g., vendor attestation, third-party

conformity assessment) can be employed in consumer software labeling pilots, the following elements

should be considered as best practices and guidelines for use in the development of a labeling pilot scheme:

 Scheme. Development of certification/testing schemes used to support the consumer software

labeling pilot program. Clearly define the approach to be used (e.g., vendor attestation, third-party

conformity assessment);

 Standard. Identify industry standards for use in the evaluation (testing) of IOT devices and

software used in any portion of a product;

 Testing. Evaluation (testing) of IOT products to ensure compliance with the applicable

cybersecurity standards;

 Certification. Certification bodies perform evaluation of products and processes used to provide

integrity of software used with any portion of a product;

 Marking. Once the IOT product has been certified the manufacturer will be authorized to use the

pilot program’s consumer software labeling; and

 Accreditation. Certification Bodies and Testing Laboratories accredited by recognized

Accreditation Bodies to ISO/IEC 17065 and ISO/IEC 17025 respectively to support

certification/testing schemes. Accreditation will support any of the approaches that may be used

(e.g., vendor attestation, third-party conformity assessment).

It is expected that the development of ANAB cybersecurity accreditation programs will support certification

and testing programs resulting from the President’s Executive Order on Improving the Cybersecurity of the

Federal Government, issued on May 12, 2021. The ANAB conformity assessment programs will enable

such certification/testing schemes to be conducted in a manner consistent with OMB Circular A-119 and

NIST Special Publication 2000-02 (Conformity Assessment Considerations for Federal Agencies).

Certification bodies and testing laboratories seeking accreditation from ANAB will be required to have

expertise in the consumer software labeling pilot program. It is expected that the development of ANAB

cybersecurity accreditation programs will build on existing accreditation programs (ISO/IEC 17021) and

will apply new programs (ISO/IEC 17065 and 17020) as well.

2
 

 

 

-------------------------------------------------------

ANAB is prepared to work with NIST and other agencies in providing educational opportunities to aid in a

better understanding of how conformity assessment works and can benefit the development of schemes to

enhance software supply chain security (pilot programs).

3