Certified EU Cybersecurity Act Specialist (EUCAS)

The Certified EU Cybersecurity Act Specialist (EUCAS) is an ECVC credential validating the ability to interpret and apply the EU Cybersecurity Act, especially Regulation (EU) 2019/881, ENISA’s role, and the EU cybersecurity certification framework for ICT products, services, processes, and managed security services. The certification confirms competence in European cybersecurity certification, assurance levels, conformity assessment, accreditation, market surveillance, national certification authorities, and the European Common Criteria-based Cybersecurity Certification Scheme (EUCC). It supports practical regulatory and compliance understanding through authoritative EU legislation and implementing regulations. Candidates gain knowledge of certification governance, ENISA’s mandate, EUCC structure, accreditation principles, certification documentation, and coordination between EU and national cybersecurity actors across the Union and industry

Why this Certification

For Organisations

Structured Compliance Awareness helps organisations turn EU cybersecurity certification requirements into practical, structured and auditable compliance awareness.
Cybersecurity Act Interpretation enables certified professionals to interpret the EU Cybersecurity Act and understand ENISA’s role within the European cybersecurity framework.
Certification Scheme Understanding supports understanding of European cybersecurity certification schemes for ICT products, ICT services, ICT processes and managed security services.
Internal Team Support assists legal, compliance, cybersecurity, procurement, product, IT, risk, audit and vendor management teams in understanding certification requirements and assurance frameworks.
EUCC and Assurance Knowledge builds knowledge of EUCC scheme requirements, assurance levels, conformity assessment and accreditation expectations.
Supplier and Procurement Evaluation improves the ability to evaluate supplier claims, review certification evidence and prepare for cyber-related procurement requirements.
Regulatory Communication enhances communication with conformity assessment bodies, national cybersecurity certification authorities, regulators and technology providers.
Cybersecurity Governance strengthens organisational cybersecurity governance, vendor due diligence, regulatory readiness and product assurance awareness.
Digital Market Trust supports trust in the EU digital single market through improved understanding of cybersecurity assurance frameworks.
Management and Board Awareness increases board-level and management-level understanding of how EU cybersecurity certification contributes to cyber resilience, market confidence, product security and EU regulatory alignment.

For Individuals

Verified Competence signals verified competence in the EU Cybersecurity Act and the European cybersecurity certification framework.
Legislation and Interpretation Skills demonstrates the ability to read EU cybersecurity legislation, interpret regulatory terminology, understand ENISA’s mandate, explain assurance levels, and apply certification concepts to practical organisational scenarios.
Professional Relevance is valuable for professionals working in cybersecurity governance, IT compliance, product security, ICT procurement, cyber risk, regulatory affairs, legal, audit, conformity assessment, accreditation, vendor management, and digital policy.
Operational Vocabulary Development helps individuals develop a practical vocabulary for working with ENISA materials, EUCC requirements, conformity assessment bodies, national cybersecurity certification authorities, suppliers, technology vendors, and internal compliance teams.
Certification Support Activities enables certified professionals to support cybersecurity certification readiness, supplier assessment, product assurance discussions, documentation review, procurement controls, internal awareness, and regulatory monitoring.
Career and Professional Credibility strengthens career credibility for professionals involved in EU cybersecurity regulation, cyber resilience, ICT product compliance, digital trust, cyber governance, and European cybersecurity certification schemes.

Learning Objectives

By the end of this certification, candidates will be able to:

Interpret Regulation (EU) 2019/881 using articles, recitals, definitions, and consolidated amendments.
Explain the purpose of the EU Cybersecurity Act in strengthening cybersecurity, cyber resilience, and trust in the EU.
Understand the mandate, role, and tasks of ENISA, the European Union Agency for Cybersecurity.
Explain the European cybersecurity certification framework for ICT products, ICT services, ICT processes, and managed security services.
Distinguish between European cybersecurity certification schemes, national cybersecurity certification schemes, certificates, and EU statements of conformity.
Understand the role of the Union rolling work programme for European cybersecurity certification.
Explain how European cybersecurity certification schemes are prepared, adopted, reviewed, and maintained.
Understand assurance levels, including basic, substantial, and high, and how they relate to risk and intended use.
Interpret the security objectives of European cybersecurity certification schemes.
Understand the role of national cybersecurity certification authorities, conformity assessment bodies, and the European Cybersecurity Certification Group.
Explain the relevance of Regulation (EC) No 765/2008 for accreditation and market surveillance in the EU conformity assessment system.
Understand how accreditation supports trust, competence, impartiality, and recognition of conformity assessment bodies.
Explain the purpose and structure of the EUCC scheme, the European Common Criteria-based cybersecurity certification scheme.
Recognise that EUCC provides a common EU assessment process for ICT products such as hardware, software, components, smartcards, chips, and technological components.
Understand the role of Common Criteria, evaluation methods, technical domains, protection profiles, and state-of-the-art documents within EUCC.
Identify how Commission Implementing Regulation (EU) 2024/3144 amends EUCC in relation to applicable international standards and corrections.
Recognise the Cybersecurity Act’s extension to managed security services as reflected in the consolidated version of Regulation (EU) 2019/881.
Support organisations in evaluating cybersecurity certification claims, supplier assurance evidence, and EU regulatory expectations.
Communicate cybersecurity certification concepts clearly to legal, IT, procurement, product, compliance, risk, and management stakeholders.
Monitor EU cybersecurity certification developments, including EUCC amendments, certification schemes under development, and future regulatory changes.

Target Audience

This certification is ideal for:

Cybersecurity compliance professionals.
IT governance, risk, and compliance professionals.
Cybersecurity managers, analysts, and consultants.
Product security and ICT product compliance professionals.
Legal counsel and regulatory affairs professionals advising on EU cybersecurity regulation.
Procurement and vendor management professionals assessing ICT suppliers.
Risk, audit, and internal control professionals reviewing cybersecurity assurance.
Information security officers and security governance teams.
Professionals working with ICT products, ICT services, ICT processes, or managed security services.
Technology vendors, software providers, hardware manufacturers, and ICT service providers.
Conformity assessment, certification, accreditation, and assurance professionals.
Public sector officers working on cybersecurity, digital trust, ICT procurement, or regulatory supervision.
Consultants supporting EU Cybersecurity Act readiness, EUCC awareness, cybersecurity certification mapping, or supplier assurance projects.
Business leaders and decision-makers responsible for cybersecurity governance, product assurance, procurement resilience, and digital trust.
Professionals seeking a practical understanding of ENISA, EU cybersecurity certification schemes, EUCC, accreditation, and market surveillance.

Exam Format

This is a closed book online proctored exam powered by ECVC examination platform:

Multiple choice questions
50 questions per exam
60 minutes duration
At least 36 questions need to be answered correctly to pass the exam
One mark awarded for every correct answer
No negative maring for wrong answers
Difficulty level: Medium-High
EQF Level: 6

Download Exam Platform Handbook

Study Material

Topics covered:

GDPR and Regulation (EU) 2018/1725
ePrivacy Directive and supervisory guidance
Lawful bases and principles
Data subject rights
Roles and responsibilities including the DPO
DPIA and risk management
Records of processing and retention
Vendor management and international transfers including SCCs
Breach detection, containment, and notification
Privacy by design and default
Governance, training, and audit

Reading materials can be found here.

The following official EU policy pages, summaries, and glossary materials are provided as authoritative contextual references. Candidates may access them here to better understand the background, policy objectives, terminology, and practical context of the EU Cybersecurity Act and EU cybersecurity certification framework. The examination primarily focuses on the mandatory primary legal sources.

Download Handbook

Prerequisites

There are no formal prerequisites. However, it is helpful to have:

Basic understanding of EU regulatory structure and key terms such as regulation, implementing regulation, competent authority, certification, accreditation, and conformity assessment.
Familiarity with cybersecurity concepts such as ICT products, ICT services, ICT processes, cyber resilience, security controls, and assurance.
Introductory knowledge of cybersecurity governance, risk management, product security, supplier assessment, or IT compliance.
Comfort reading legal or regulatory texts and summarising requirements for stakeholders.
Awareness of EU institutions, ENISA, national authorities, and how official EU legislation and guidance are published.
Experience in a related field is helpful but not required, for example cybersecurity, IT, compliance, legal, procurement, audit, risk, product development, vendor management, or regulatory affairs.
Suitable for both technical and non-technical professionals involved in EU cybersecurity regulation, cybersecurity certification, ICT procurement, cyber governance, digital trust, or product assurance.