Market of Cybersecurity Assessments 2021 - 2025

The Cybersecurity Assessment report aims to present the current state of play of cybersecurity assessments of ICT products, cloud services, ISMS, and managed security services along with the conformity assessment bodies involved with such schemes. 

This present version is an update from the initial report published in January 2024. Some frameworks have been removed from the study due to lack of data or irrelevance.

The two major changes are the introduction of data regarding the first EU cybersecurity certification scheme, EUCC, and the inclusion of a new category of ICT solutions: managed security services. The type of MSSs included in the report is based on the definition and examples of activities provided in the targeted amendment of the Cybersecurity Act giving the mandate to ENISA to develop certification schemes for such activities.

To study the dynamic of the related market, the report focuses on the evolution of the number of assessed ICT solutions and assessment bodies in the past 5 years, between 2021 and 2025. It considers the several ways to assess cybersecurity of ICT solutions such as standards, national, and private, certification schemes and methodologies.

The report also focuses on conformity assessment bodies, the cornerstone of cybersecurity assessments.

Ultimately, with this report ENISA wants to track the uptake of the new EU cybersecurity certification scheme such as EUCC.