The relevance of information security is not limited to ‘digitally native’ businesses: it is increasingly relevant for all sectors, including traditional industries. The security of information and communication systems is an area of increasing concern, both for public authorities and for private companies. While ICT technologies open up new opportunities, they also create threats to operational safety, robustness, and resilience. Standards can help mitigate this kind of cyber risk. Part of this work consists of collecting the new best practices that allow manufacturers and service providers to improve the security features of products, services, and processes and boost consumers’ trust in the digital environment.
Furthermore, to ensure a horizontal application of cybersecurity requirements for digital products, in 2022, the European Commission published a proposal for the Cyber Resilience Act (CRA). The implementation of this important piece of legislation will rely on harmonized standards. The technical bodies involved in the preparatory work currently include CEN-CLC/JTC 13 ‘Cybersecurity and Data Protection’, CLC/TC 9X ‘Electrical and electronic applications for railways’, CLC/TC 47X 'Semiconductors and Trusted Chips', CLC/TC 65X ‘Industrial-process measurement, control and automation’, CLC/TC 205 ‘Home and Building Electronic Systems (HBES)’, and CEN/TC 294 ‘Communication systems for meters’.
CEN-CLC/JTC 13 ‘Cybersecurity and Data Protection’ is responsible for the development of standards for cybersecurity and data protection, covering all aspects of the evolving information society. In 2025, CEN-CLC/JTC 13 will finalize and publish FprEN 18037 ‘Guidelines on a sectoral cybersecurity assessment’. This document is to be used in the process of drafting the requirements of cybersecurity certification schemes for sectoral ICT services and systems, and it includes all steps necessary to define, implement, and maintain such requirements. The technical committee also oversees the Cyber Resilience Act and its potential standardization needs.
The Cybersecurity Resilience Act (CRA) requires a robust implementation plan, particularly for semiconductor technologies. The CLC/TC 47X 'Semiconductors and Trusted Chips' technical committee is essential to address the standardization needs of semiconductors, which are vital for Europe’s technological leadership. Semiconductors are critical for the automotive sector, connected devices, as well as for supply chain integrity, all of which influence hardware vulnerabilities, national security, economic impact, and long-term resilience.
Given the complexity of the global semiconductor supply chain, ensuring the security and integrity of chips is crucial for overall cybersecurity infrastructure. CLC/TC 47X collaborates with the European Commission through the ‘Trusted Chips’ project, led by DKE, to address gaps in cybersecurity standards and certification.
In 2025, CLC/TC 47X will focus its standardization efforts on three Working Groups (WGs):
- Microprocessors and Microcontrollers with security functionalities;
- Microprocessors and Microcontrollers with tamper-resistant features;
- Smartcards and Secure Elements platforms.
In 2025, in cooperation with the identified liaisons, CLC/TC 47X will work on the standardization deliverables required to support the Cyber Resilience Act, to enhance the security and integrity of semiconductor chips and the overall resilience of cybersecurity infrastructures.
CEN-CLC/JTC 25 ‘Data management, Dataspaces, Cloud and Edge’ was created in 2024 and will launch its activities in early 2025.
The establishment of this new joint technical committee is a direct consequence of the necessity to create an environment that will facilitate the development of technical standards in support of current European market regulations and strategies in relation to data.
In 2025, CEN-CLC/JTC 25 will work on the first phase of delivering standardization documents in support of the draft Standardization Request on European Trusted Data Frameworks, which is currently under development.
CEN/TC 468 ‘Preservation of digital information’ is dedicated to working on the standardization of the functional and technical aspects of the preservation of digital information. In this field, the technical committee will develop a structured set of standards, specifications, and reports to address business requirements, including compliance with the European legislative and regulatory framework (such as GDPR and eIDAS).
In 2025, two documents already under development are expected to be published:
- TR ‘Mapping of existing standardization deliverables on European digital archiving and preservation’
- TS ‘Functional requirements for the electronic archiving services’
CEN/TC 428 ‘ICT Professionalism and Digital Competences’ is responsible for all aspects of standardization related to digital competences and maturing the ICT profession in all sectors, both public and private.
This includes activity related to four major building blocks of ICT professionalism incorporated into competences, education and certification, Code of Ethics, and Body of Knowledge (BoK).
CEN/TC 428 is focused on the creation of a strong set of standards that will address specific ICT sectors (such as Artificial Intelligence and Software).
In 2025, CEN/TC 428 will aim to maintain and revise published standards, with specific attention on creating assessments and certifications and providing a strong interaction of these standards with other frameworks.
QUANTUM TECHNOLOGIES