## 6 Conclusions and Future Work  
The proposed security evaluation methodology provides several significant advantages. First, it introduces automation and dynamic features, which simplify the traditionally complex and resource-intensive certification processes. The combination of automated testing, dynamic labeling, and clear visual communication supports both technical and non-technical stakeholders, enabling informed decision-making and fostering trust. Second, the methodology's adaptability to different operational contexts through the use of tolerance profiles makes it suitable for a wide variety of ICT systems, from simple devices to complex interconnected platforms. Lastly, the ability to integrate and reuse previous evaluations while incorporating sensitivity factors ensures efficiency without compromising the accuracy of security assessments. To further validate and refine this methodology, future work will involve conducting a series of case studies to evaluate and rate each component of the framework. This approach will guide targeted enhancements to better address practical challenges encountered during implementation. Additionally, we will investigate how to extend the methodology with semi-automated procedures to address issues encountered during the evaluation process before treatment sharing. In relation to this, we will consider technologies and mechanismssuch as Hyperledger and threat MUD to support secure information sharing between relevant stakeholders and to launch the required processes to update the information contained in the QR code of the label. The proposed methodology, while focused on technical risk management, can also be aligned with organizational risk governance, as outlined in the ISO 31001-3 standards, enabling stakeholders to make informed decisions that balance technical security needs with business objectives. For example, the context establishment phase can include analyzing how ICT system risks align with enterprise risk management frameworks, regulatory compliance, and strategic goals. Similarly, the treatment phase could support the prioritization of mitigation efforts based on their impact on both technical security and business outcomes. Further organizational risk management could be explored as part of the methodology's future work. Although coordination between stakeholders and regulatory bodies is key to defining a comprehensive cybersecurity certification framework, the proposed methodology is intended to serve as a basis for a more standardized and uniform approach. With ongoing advancements, this methodology is expected to evolve in alignment with EU regulations and ENISA guidelines, contributing to a cohesive and adaptable certification landscape in the coming years. Conceptualization, S.N.M. ; methodology, S.N.M., J.F.M.-G., I.B., J.M., R.P., and A.S.; software, J.F.M.-G., I.B., J.M., and R.P. ; validation, S.N.M., J.F.M.-G., I.B., J.M., and R.P. ; writing--original draft preparation, S.N.M., J.F.M.-G., I.B., J.M., R.P., and A.S.; writing--review and editing, S.N.M. and R.P. ; supervision, S.N.M. and A.S. All authors have read and agreed to the published version of the manuscript. This work has been partially funded by the European Commission through the projects H2020-952702 BIECO, H2021-101069471 CERTIFY, and DOSS (grant no. 101120270). Not applicable. Data Availability Statement: Data is contained within the article. Conflicts of Interest: Author [PERSON] was employed by ResilTech s.r.l., author [PERSON] and [PERSON] were employed by 7 bulls.com. The remaining authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.