IPA Publishes SCS Evaluation Guides and Explanatory Materials
Overview
IPA published guides for self-assessment, third-party assessment, and technical verification toward obtaining SCS Evaluation System levels 3 and 4, along with an explanatory document on requirements and assessment criteria. It also updated the system website and expanded its Q&A. In preparation for the system launch, IPA is advancing plans to publish an application guide and designate and announce relevant service providers.
Key points
- IPA published three assessment guides for obtaining levels 3 and 4, along with an explanatory document on requirements and assessment criteria.
- IPA updated the content and structure of the system website and expanded its Q&A.
- In preparation for the system launch, IPA plans to publish an application guide and designate and announce relevant service providers.
Overview
IPA explains that security incidents across supply chains occur frequently, making it an important challenge to strengthen countermeasures, including among business partners. The SCS Evaluation System encourages stronger security measures that include business partners and aims to raise the level of countermeasures throughout the entire supply chain. As the system's scheme owner, IPA is preparing for its launch and has already published system rules and the registration fees required of users.
Details
The published materials are the “Levels 3 and 4 Self-Assessment and Related Guide,” the “Level 4 Third-Party Assessment Guide,” the “Level 4 Technical Verification Guide,” and the “Levels 3 and 4 Requirements and Assessment Criteria: Explanatory Guide.” The first three cover assessment procedures and related matters for obtaining levels 3 and 4, while the explanatory guide describes measures for meeting the requirements and assessment criteria.
The Self-Assessment and Related Guide sets out procedures for organizations seeking registration to determine the unit of certification and scope of application, conduct self-assessments, and undergo reviews by level 3 confirmation managers and others. The Third-Party Assessment Guide covers level 4 third-party assessment procedures conducted by assessment bodies. The Technical Verification Guide covers level 4 technical verification procedures conducted by assessment bodies and technical verification providers, as well as points for organizations seeking registration to bear in mind. The explanatory guide describes the principles and considerations for organizations seeking registration to set the unit of certification and scope of application and conduct self-assessments and related activities.
The intended readers include organizations seeking level 3 or level 4 registration, level 3 confirmation managers and others, assessment bodies, technical verification providers, and SCS security experts. Going forward, IPA plans to publish the “Levels 3 and 4 Registration Application Guide,” establish a system logo, and designate and announce assessment bodies, technical verification providers, and training providers.