Stage one

Apply for certification

Submitting an application costs nothing and commits you to nothing. It begins the eligibility and scope review, at the end of which the Agency issues a scope statement and a fee schedule for you to accept or decline.

The organisation

Legal name * As registered, including the legal form (OÜ, GmbH, S.à r.l., Ltd and so on).

Registration number

Country of registration *

Website

Number of staff

Contact person

Full name *

Position

Email address *

Telephone

Certification sought

Programme *

Level * If you are unsure, choose the level you believe fits. The Agency confirms or proposes an alternative at stage two.

Proposed scope * What should the assessment cover: which product or service, which systems and environments, which categories of data, and which parts of the organisation. State also what should be excluded.

Anything else the Agency should know Existing certifications, deadlines imposed by a customer or investor, known gaps, or a pending incident.

Declaration

I confirm that I am authorised to submit this application on behalf of the organisation named above, that the information given is accurate to the best of my knowledge, and that I have read the legal notice and the privacy statement. *

No fee is payable at this stage.

Documents to prepare

Nothing needs to be attached to this application. After the scope review you will receive an evidence request specific to your programme. It normally asks for:

Information security policy and supporting procedures
Asset, data and supplier inventories
Records of processing activities
Access control configuration and administrative account listing
Architecture or infrastructure documentation for the assessed scope
Backup configuration and evidence of a restoration test
Incident register and response procedure
Results of any recent security testing

The precise list depends on the programme. See the programme page for details.

Before you apply

If you are not sure which programme or level applies, or whether certification is worth doing at your stage, ask the Agency first. There is no charge for that conversation and no obligation follows from it.

EDCA is an independent certification organisation and is not an institution, agency, or official body of the European Union. Certification is an assessment against the Agency's own published standards.