· CYBSER
CPSTIC taxonomies 2026: a common foundation for security requirements
The CCN is harmonising requirements, threats and assets common to security products. Each family adds requirements for its own functions.
CYBSER Blog
Practical analysis on certification, CPSTIC, cloud delivery and security requirements for regulated products and services.
What you will find here
We explain methodologies, CPSTIC access routes, how to choose between CICLON and LINCE, and the technical criteria that affect cloud products, on-premises software and regulated environments.
Key topics
CICLONLINCECPSTICENSCloudCertification
Start with the CCN-STIC guides
If your search starts from a specific CCN-STIC guide, this layer separates evergreen content from the blog stream and points you first to the documents that most affect route fit, methodology and evaluation readiness.
· CYBSERLINCE 2.1: changes to evaluation effort and timelines
The updated CCN-STIC 2001 and 2002 guides change how evaluation effort and duration are calculated. Here is what changes when planning your evaluation.
· CYBSERNew CCN-STIC 106: what changes for your product’s CPSTIC inclusion?
The October 2026 changes that matter most for your project: cloud products, compliance tools, scope review and deadlines.
· CYBSERESP-IA: the new CCN methodology for evaluating the security of AI-enabled products
What ESP-IA (CCN-STIC 2011) is, how it determines which requirements your product will be held to, and what AI vendors should start preparing.
· CYBSERHow to prepare the Service Architecture Document (DAS) for CICLON
What the DAS for CICLON must include, what the laboratory will review, and what should be clear before the evaluation begins.
· CYBSERCICLON guide for including cloud products in CPSTIC
What CICLON is, how its iterative evaluation works, and why this methodology matters for cloud products targeting the Spanish public sector.