{
  "url": "https://openlegislation.uk/eu-regulation-2016-799/annex-1/appendix-10",
  "json_url": "https://openlegislation.uk/eu-regulation-2016-799/annex-1/appendix-10.json",
  "legislation": "eur/2016/799",
  "legislation_title": "Commission Implementing Regulation (EU) 2016/799 of 18 March 2016 implementing Regulation (EU) No 165/2014 of the European Parliament and of the Council laying down the requirements for the construction, testing, installation, operation and repair of tachographs and their components (Text with EEA relevance)",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2016-799",
  "path": "annex/1/appendix/10",
  "kind": "appendix",
  "number": "10",
  "heading": null,
  "text": "SECURITY REQUIREMENTS\nThis appendix specifies the IT security requirements for the smart tachograph system components (second-generation tachograph).\nSEC_001\nThe following components of the smart tachograph system shall be security certified according to the Common Criteria scheme:\nvehicle unit\ntachograph card,\nmotion sensor,\nexternal GNSS facility.\nSEC_002\nThe minimum IT security requirements to be met by each component needing to be security certified shall be defined in a component Protection Profile, according to the Common Criteria scheme.\nSEC_003\nThe European Commission shall make sure that four Protection Profiles compliant with this Annex are sponsored, developed, approved by the governmental IT security certification bodies organised within the Joint Interpretation Working Group (JIWG) which is supporting the mutual recognition of certificates under the umbrella of the European SOGIS-MRA (Agreement on Mutual Recognition of Information Technology Security Evaluation Certificates) and registered:\nProtection Profile for vehicle unit,\nProtection Profile for tachograph card,\nProtection Profile for motion sensor,\nProtection Profile for external GNSS facility.\nThe Protection Profile for vehicle unit shall address the cases when the VU is designed to be used or not with an external GNSS facility. In the former case, the security requirements of the external GNSS facility are provided in the dedicated Protection Profile.\nSEC_004\nComponent manufacturers shall refine and complete the appropriate component Protection Profile as necessary, without amending or deleting existing threats, objectives, procedural means and security enforcing functions specifications, in order to build a Security Target against which they shall seek the security certification of the component.\nSEC_005\nStrict conformance of such specific Security Target with the corresponding Protection Profile must be stated during the evaluation process.\nSEC_006\nThe assurance level for each Protection Profile shall be EAL4 augmented by the assurance components ATE_DPT.2 and AVA_VAN.5.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2016/799/annex/1/appendix/10",
    "retrieved_at": "2026-11-01T14:45:49.686558+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}