Certification bodies and cybersec frameworks --- This is an interesting question, Alan.

On national levels, there are various accredited institutions/companies which deliver training and certification on behalf of those global certification bodies. Whether they are included in the development of national frameworks depends on the level of inclusiveness and openness of a particular government towards other stakeholders in shaping the national framework. Whether they should be involved - they certainly should, since their work can serve as (parts of) security baseline requirements set by national policies, and these institutions know what are the key challenges with certification.

On the international level, interestingly, all these communities seem to work in silos. I haven't seen much of the involvement of international standardisation organisations or big global certification bodies in cyber-norms processes, for instance. There is a need to bring those groups closer to policy-making processes - and make policy-makers more awareness of the role of certification and standards in general.

Source author: Vladimir Radunovic vladar@diplomacy.edu