The government plans to set up a national certification agency to certify upcoming private sector laboratories in the area of electronics and information technology.

Testing of equipments being an extremely important part of maintaining a secured digital infrastructure, the job of testing and certification is at present done by standardisation testing and quality certification (STQC) directorate, under the department of electronics and information technology, DeitY.

The proposed national agency will be independent of STQC, which runs a regional lab in Kolkata, secretary, DeitY, RS Sharma said while speaking at the 15th international common criteria conference (ICCC) organised by STQC, DeitY, and CII in New Delhi on Tuesday.

India was last year recognised as an ‘authorising nation’ for CCRA certification to test and certify electronics and IT products with respect to cyber security. This will help the country become a hub for testing.

The authorisation status will give Indian electronics and IT manufacturing industry and government a collaborative environment for realising prime minister’s vision of ‘make in India’, Sharma said.

Deputy national security advisor Arvind Gupta said the authorisation status will help India become a hub for security assurance of IT services and products.

According to Ashit Vora, lab director, Acumen Security, a US-based testing company, India can become a hub for testing as the difference in cost of testing in an Indian lab vis-a-vis a lab based in the US or Europe is around 50 percent. Vora said his company is already setting up a lab in Mumbai. The expertise of the labs, however, will also be a deciding factor in attracting IT and communications manufacturers for getting their products tested specifically in India.

The testing labs will evaluate the electronic and IT products as per the ‘common criteria’, an international standard for computer security certification and submit its report to the national agency. The agency will validate the evaluation of the labs and issue the certification report. The agency will depute a validator for each evaluation project. 

“The agency will be completely independent. It will have more people, capacity and authority so that we can empanel more labs,” an official associated with STQC directorate said.

All equipments under IT and communications will come under the certification. “For telecom, we will draw a separate certification framework, though the baseline evaluation will be the same,” the official said.

There is a mutual recognition arrangement between a group of 26 countries (which includes India) on accepting test reports. Of these, 17 are authorising nations, which means they can generate their own certificates as per common criteria.

The remaining nine are consuming nations, and can accept certificates from this group but not issue a certificate on their own.

The proposed agency will be set up under DeitY within six months, it is learnt.

In the US the certification body works directly under NSA, while it is under the ministry of interior in France.