Albania Establishes National Cybersecurity Certification Scheme

Albania has drafted a national cybersecurity certification scheme that defines security levels for information technology products, establishing mandatory certification and post-transparency obligations for manufacturers.

Compliance Answer: Albania’s National Cybersecurity Certification Scheme

Direct Answer

Albania’s draft Decision of the Council of Ministers “On the Approval of the National Cybersecurity Certification Scheme, as well as the Security Levels of the Scheme” establishes a mandatory cybersecurity certification framework for information technology (IT) products. The scheme defines two security levels (“considerable” and “high”), imposes certification obligations on manufacturers, and introduces post-certification transparency and vulnerability management duties. Certification is valid for up to 5 years, with extensions requiring approval from the National Cyber Security Authority^{1, 2}.

Regulation Analysis

1. Security Levels and Certification Requirements

The scheme mandates certification for IT products at two security levels, aligned with Common Criteria (CC) assurance levels (AVA_VAN):

• “Considerable” security level: Covers AVA_VAN 1 or 2¹.
• “High” security level: Covers AVA_VAN 3, 4, or 5¹.

Certification is required for products to demonstrate compliance with these levels, and the scheme distinguishes between standard and enhanced security component usage based on the certified level¹.

2. Certification Process and Obligations

a. Certification Steps

1. Application: Manufacturers submit documentation to a certification body (authorized by the National Cyber Security Authority) and an IT Security Evaluation Facility (ITSEF)^{1, 2}.
2. Evaluation: ITSEF conducts technical assessments (e.g., structured interviews, pilot certifications) and issues a technical evaluation report¹.
3. Certification: The certification body issues a certificate (electronic format) and a certification report (publicly available, detailing security features, installation guidance, and evaluation results)^{1, 2}.
4. Public Disclosure: Manufacturers must make cybersecurity-related information publicly accessible in Albanian¹.

b. Post-Certification Obligations

• Document Retention: Manufacturers must securely retain:
  • Certification documentation (submitted to the certification body/ITSEF)¹.
  • A copy of the certified IT product¹.
  • Retention period: 5 years post-certificate withdrawal¹.
• Vulnerability Management:
  • Manufacturers must monitor, analyze, and report vulnerabilities affecting certified products¹.
  • Immediate reporting to the certification body or National Cyber Security Authority is required for discovered vulnerabilities¹.
  • Cooperation with other cybersecurity authorities (e.g., EU authorities post-accession) for cross-border vulnerability disclosures¹.

3. Monitoring and Compliance Enforcement

• Ongoing Monitoring: Certification bodies monitor:
  • Manufacturer compliance with obligations (e.g., vulnerability management)¹.
  • Product compliance with security requirements¹.
  • Protection profiles (security specifications for product categories)¹.
• Random Audits: The National Cyber Security Authority selects certified products for random audits based on:
  • Product category, assurance levels, certificate holders, or reported vulnerabilities¹.
• Non-Compliance Consequences:
  • 30-day corrective action period for violations (e.g., failure to report vulnerabilities)¹.
  • Suspension or withdrawal of certification for unresolved non-compliance¹.
  • Repeated violations trigger mandatory certificate withdrawal¹.

4. Transparency and Information Sharing

• Public Disclosure: Manufacturers must provide:
  • Certificate validity information¹.
  • Publicly accessible cybersecurity details (e.g., security features, installation guidance)¹.
  • Historical certification data for traceability¹.
• Confidentiality: Vulnerability exploit details are not disclosed to the National Authority, but verification powers remain intact¹.

5. EU Alignment and Future Integration

• The scheme references EU Regulation 2019/881 (Cybersecurity Act) and Implementing Regulation (EU) 2024/482 (EUCC scheme), signaling alignment with EU standards².
• Post-EU accession, Albania’s National Cyber Security Authority will notify the European Cybersecurity Certification Group (ECCG) of:
  • Certificate extensions beyond 5 years¹.
  • Cross-border vulnerability investigations¹.

Summary Answer

Albania’s draft National Cybersecurity Certification Scheme introduces a mandatory two-tier certification system (“considerable” and “high” security levels) for IT products, with validity up to 5 years¹. Manufacturers must undergo technical evaluation by an ITSEF, retain documentation for 5 years post-withdrawal, and comply with vulnerability reporting obligations (30-day corrective action period)¹. The National Cyber Security Authority enforces compliance through random audits and may suspend/withdraw certificates for non-compliance¹. The scheme aligns with EU cybersecurity standards, including the EUCC scheme, and mandates public transparency in Albanian^{1, 2}. Post-EU accession, Albania will coordinate with EU authorities on cross-border cybersecurity matters¹.

Sources

1. ↩ WTO TBT notification 25-09201 — Albania https://members.wto.org/crnattachments/2025/TBT/ALB/25_09201_00_e.pdf
2. ↩ Draft –Decision of the Council of Ministers “On the Approval of the National Cybersecurity Certification Scheme, as well as the Security Levels of the Scheme” https://docs.wto.org/dol2fe/Pages/SS/directdoc.aspx?filename=Q:/G/TBTN25/ALB100.pdf&Open=True