New CCN-STIC 106: what changes for your product’s CPSTIC inclusion?

If you want to include your product in Spain’s CPSTIC Catalogue, the updated CCN-STIC 106 affects how you choose the evaluation, prepare the documentation and plan the project.

The October 2026 edition updates the inclusion procedure. Compared with April 2024, there are four main changes, which we detail below.

1. For cloud products, CICLON is now explicitly included

The guide incorporates CICLON as the evaluation methodology for cloud security products. A one-off assessment is not enough: monitoring forms part of the process and can affect the product’s continued inclusion and category in the catalogue.

For your project, this means preparing for the initial evaluation and planning how inclusion will be maintained as the service evolves. Renewal requires a new CICLON evaluation and a complete application.

Cloud renewal already existed in the previous edition. The change is the explicit incorporation of the CICLON framework in the guide. See how we handle CICLON evaluations.

2. Compliance and governance tools have a dedicated procedure

Not every product follows the same route. A GRC, ENS compliance support or security awareness tool may belong in the Conformity and Governance list, depending on its function and provided it does not form part of the system’s security architecture.

The list already existed. The revised guide develops its entry procedure, including penetration testing and specific evidence. Cloud solutions must also demonstrate valid ENS certification for the systems where the product is deployed.

3. Scope can be reviewed before certification is completed

For products deployed on the customer’s infrastructure that are not yet certified, the guide develops a preliminary review of the proposed security scope and how catalogue requirements will be covered.

This is an opportunity to identify gaps before completing certification. It reduces the risk of reaching the end only to discover missing requirements or the need for additional testing.

The review does not replace certification or guarantee inclusion. It helps establish whether the proposed scope meets CPSTIC requirements.

4. Plan for both the application and continued inclusion

The revised edition sets one year per qualification procedure, starting from its formal start notification. A justified six-month extension may be requested before the deadline expires.

That year is neither an estimate of your project’s duration nor a promise of approval. It is the procedure deadline: documentation, testing and remediation need to be coordinated to meet it.

Catalogue inclusion also has a validity period that depends on the route. For cloud and Conformity and Governance products, renewal requires a new evaluation after two years. Products qualified through LINCE or Common Criteria can be renewed until the end of the product’s security support, up to a maximum of five years from the certification date. Planning should extend beyond entry to cover renewal and product changes.

We handle the process

At CYBSER, we identify the appropriate route for your product, prepare the documentation and manage the evaluation and inclusion application. We make the process easier at every step so your team only has to step in where it really matters.

Tell us about your product and where you are in the process so we can review the steps your project needs.

For the procedural detail, see our CCN-STIC 106 practical guide.

Comparison of the Spanish editions of April 2024 and October 2026. Source: official CCN-STIC 106, Spanish PDF, sections 4.1.2, 4.5, 5 and 6 of the October 2026 edition. An official English version is also available.