## 3 Security Evaluation Methodology for ICT Systems  
Figure 1 shows the overall process of certification that we propose. It is derived from the ETSI proposal [4], which combines an extended security assessment derived from ISO 31000 and typical security testing activities following the ISO 29119 standard. Building on this approach, we define a cybersecurity certification framework based on two core components outlined in the ETSI proposal: _security testing_ and _security risk assessment_. Security testing focuses on identifying flaws, vulnerabilities, and other technical issues, while security risk assessment addresses potential vulnerabilities with an emphasis on legal and business concerns. The process begins with _establishing the context_, which lays the foundation for both streams by analyzing the environment in which the device or component will be evaluated. The methodology incorporates _Continuous communication and auditing_ to maintain a management perspective, ensuring continuous oversight and control of the information generated from assessment and testing processes. The _treatment_ phase provides targeted security countermeasures based on the identified risks. Finally, the methodology also includes specific activities related to certification. In particular, a _labeling_ activity has been integrated after the risk assessment process, which is in charge \begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline
**Framework** & **Objectivity and Harmonization** & **Context** & **Cost Time** & **Dynamism** & **Labeling** \\ \hline \multirow{4}{*}{**CC**} & Based on standard methods, CPP and MRA, heavy reliance on manual evaluation & Considered as PP & High cost and slow & Static evaluations notsuited for frequent re-certifications, requiring a full re-assessment & Label considered for assurance levels \\ \hline \multirow{4}{*}{**CSPN**} & No formal methods and heavy reliance on manual evaluation & Evaluation on a representative execution environment & Low cost and fast & Static evaluations without support for life-cycle updates or evolving threats & No label \\ \hline \multirow{4}{*}{**CPA**} & Subjective and heavy reliance on manual evaluation & Not consider-red & Moderate cost and slow & Static certification & No label \\ \hline \multirow{4}{*}{**CAP UL**} & Private methods not validated by the community & Context considered in the report & Cost-intensive for small-scale systems and significant time investment & Static evaluation process; does not support continuous monitoring or recertification. & \multirow{4}{*}{No label} \\ \hline \multirow{4}{*}{**ARMOUR**} & Based on standard methods but focused on IoT & Considered as PP & Low cost and time & Static evaluation process & Visual label \\ \hline \multirow{4}{*}{**Our proposal**} & Based on standard methods and support for complex systems & Considered as tolerance profiles & Reduces cost and time via automation and composition & Incorporates continuous monitoring and dynamic development & Visual and dynamic label \\ \hline \end{tabular}
\end{table} 
Table 1: Comparison between the main certification frameworks. of communicating the security level obtained for a specific Target of Evaluation (TOE). While the CC framework defines the TOE as a collection of software, firmware, and/or hardware with accompanying guidance, our approach extends this definition to include the TOE's configuration (e.g., specific protocols, libraries, or cryptographic parameters, among others). This work proposes the use of specific technologies and tools for security risk assessment and testing processes as the main building blocks to build a security certification approach for ICT systems. It represents, in turn, an extension of the methodology proposed by ETSI and supported by other standards to take advantage of its standardized basis. Table 2 shows an overview of the concepts and processes taken from different standards that support the proposed methodology, which will be further detailed in the next subsections.