Deciphering Cyber-Security Certifications: An Ontological Journey through Composite Systems and their certification

As cyber-physical systems become increasingly interconnected and complex, ensuring their cyber security becomes paramount. Composite systems, comprised of multiple interconnected components, present unique challenges for cyber security certification due to their dynamic nature and diverse elements and used technologies. This paper proposes the development of an ontology specifically tailored for the cyber security certification of composite systems. Ontologies provide a structured framework for representing knowledge, allowing for semantic interoperability and in future automated reasoning. This ontology also aims to capture the intricate relationships between components, vulnerabilities, threats, and security controls within composite systems. Multi-layered approach employed, encompassing both technical and organizational aspects of cyber security, comprehensively address certification requirements. Also, we discuss the practical implications of proposed ontology in streamlining certification procedures, enhancing risk management, and promoting trustworthiness in composite systems. Through this work, we strive to contribute to the advancement of cyber security certification practices, EU regulation in the context of evolving composite systems (EU Common Criteria Framework).