Develop an evidence-based security assurance and certification methodology identifying security claims and metrics.
This objective defines the set of claims to manage security assurance not based on trust but on evidences, and competitively, as it defines the set of metrics to be used to measure the security and the design of the methodology to be followed to manage security certification metrics. Moreover, this objective also targets the design of audit (as much as possible automatic) procedures in ICT systems, by considering all ICT components within the supply chain.