iKNSA International
Self-assessment10 to 15 minClient areaContact iKNSA

Guidance by trigger

The triggering event determines the order of the analysis.

A questionnaire, an audit, market entry or the maintenance of several engagements each call for distinct decisions and levels of evidence.

Review situations

A client request exists

Security questionnaireContractual annexAnnounced auditFindings received

A decision needs to be prepared

RenewalEU call for tendersEU market entryProduct security

The role determines the mandate

The supplier examines its own capability. The European client defines the supplier decision it needs to reach.

Self-assess my organisation →Assess a supplier →Search the platform →

Choose an engagement

Meet the deadline. Establish capacity. Sustain commitments.

Start from what needs to be obtained now: an answer, an in-depth review, or a capability tracked over time.

View all engagements
01

Reply

A document and a deadline.

QuestionnaireAnnexAuditAll responses →
02

Prepare

Verify and remediate.

EU exposureClient and technical assessmentEvidence and remediationAll preparations →
03

Maintain

Keep the current commitments.

Continuous assuranceClient assurance officeProduct security cellAll recurring services →

Basis for the conclusions

From the client's requirement to a qualified piece of evidence.

The same trail links Promise, Policy, Practice, Platform, finding, remediation and controlled sharing.

Review the 4P method

Trace

Evidence traceabilityAssurance registerTrust roomContinuous verification

Frameworks and sectors

GDPR and international accessHealth data and HDSNIS2 and the supply chainIndustrial confidentialityAll frameworks →

View deliverables

See fictitious examples to understand the structure and depth of the deliverables.

See examples of deliverables →

Terms of engagement

Responsibilities, information and limits established before the engagement.

Confidentiality, independence, reversibility and traceability of responsibilities structure the conduct of the work.

Review the firm's rules

Trust rules

ConfidentialityIndependenceSecurityReversibility

Working with iKNSA

ExpertiseInternational engagementsRequest an engagementContact

European principals

Have an international supplier assessed under explicit mandate and sharing rules.

Assess a supplier →
Your contextContext not defined
Country of the organisation assessedNot provided
What it providesNot provided
Relationship with the EUNot provided
Home / Maintain

Maintain

Product security and CRA cell

Maintain governance of products, vulnerabilities, dependencies, patches, incidents and evidence within a continuous organisation.

In your situation

What the scoping will need to take into account.

Operated capacity

Operate product security sustainably, from versions to vulnerabilities.

The unit links each report and vulnerability to the affected versions, remediation decisions, communications and evidence from the product lifecycle.

Subject of the work

The unit links versions, vulnerabilities, patches and product decisions.

Demonstration example
01Operate the PSIRT and coordinated disclosureProduct register
02Track vulnerabilities and dependenciesVulnerability process
03Maintain documentation and supportEvidence file
04Prepare the elements required for notificationsPreparation timeline

How it actually unfolds

Set up a capability that remains operable over time.

Working format

Recurring product coordination cell linking reports, vulnerabilities, versions, patches, support and evidence.

Client-side mobilisation

Product and engineering teams qualify and then execute the decisions; communication and escalation roles remain assigned.

Starting elements

Portfolio and versions, components, reporting channels, vulnerabilities, incidents, support policies and obligations to be qualified.

Building the schedule

The pace follows the versions released, the reports received, the correction windows and the notification deadlines applicable to the product concerned.

Operating cadence

Maintain product governance connected to engineering decisions.

01Operate the PSIRT and coordinated disclosureThe PSIRT assigns reports, protects the exchanges and coordinates the disclosure decision with the relevant roles.
02Track vulnerabilities and dependenciesVulnerabilities and components are linked to the corresponding products, versions, exploitability status and remediation decisions.
03Maintain documentation and supportDocumentation, support and maintenance periods evolve with the versions delivered rather than in files separate from the product.
04Prepare the elements required for notificationsThe elements required for a notification are prepared from qualified facts and submitted to the applicable approvals.

Status maintained

The living record of product security decisions.

AssetProduct register

The register retains, for each product, the versions released, the support period and the security decisions still open.

PlannedVulnerability process

The process follows a report from receipt through to qualification, remediation and coordinated communication.

To be reviewedEvidence file

Architecture, SBOM, tests, vulnerabilities and risk decisions remain linked to versions actually distributed.

MaintainedPreparation timeline

The schedule cross-references end-of-support dates, component reviews, processing exercises and the portfolio's documentary deadlines.

Scoping the engagement

Size the team to match the portfolio and support periods.

The portfolio, support periods and reporting channels make it possible to size the ongoing governance of versions and vulnerabilities.

Scope this engagementView the client area →