Sources, versions and working methods
Security research and evidence
A reading route for people checking a supplier claim, choosing evidence and keeping an assurance decision current.
Choose the question you need to answer
- Does this certificate cover the service? Check the named entity, activity, dates and issuer.
- Who issued it, and what does accreditation describe? Separate the roles behind the marks.
- What evidence supports the supplier's answer? Keep claims, limitations and actions together.
- When should the decision be reviewed? Record a date and the changes that trigger an earlier check.
A historical research record
The former CRISP project produced Deliverable 2.2, Consolidated report on security standards, certification and accreditation – best practice and lessons learnt. The official VUB catalogue record lists Simone Wurster and co-authors, publication on 30 June 2015, English language and 539 pages.
The record links to a repository file named CRISP_Deliverable_2.2_update_Jan17final1.pdf as a final published version. That filename differs from the historical 2015 file URL. We have not established that the two files are identical or confirmed permission to republish the report. The old PDF has not been restored here. Use the official catalogue for access and version information.
This is a new independent editorial section, not the former project's research archive. The earlier researchers are not presented as authors of the current guides. This edition does not own or operate the former project's certification scheme.
Primary references for a current review
- ISO: conformity assessment — a reference for the roles of testing, inspection and certification.
- ISO: certification — guidance on the issuer and accreditation checks.
- NIST SP 1326: due-diligence assessment — a guide scoped to ICT suppliers.
- NIST Cybersecurity Framework FAQs — background for organising cybersecurity outcomes.
Use a reference without overstating it
Record a source's title, version, date and the question it answers. Keep a source-backed description separate from your own acceptance decision. A reference list does not certify a supplier or establish that a control has operated.
For a practical start, open the supplier evidence worksheet. Read our editorial policy for how we handle sources, examples and commercial contributions.