Pursuant to the Royal Decree 421/2004, of 12 March, the National Cryptologic Centre (CCN) is responsible for “establishing the National Scheme for Evaluation and Certification of Information Technology Security, applicable to related products and systems".

As regards the functional certification of IT security, the Certification Body was established in accordance with the Regulation on Evaluation and Certification of Information Technology Security, adopted by the Order PRE/2740/2007, of 19 September, and supplemented by its own internal regulation, amended to meet the necessary requirements to qualify for recognition as the CIS security certification body, both at a national level —pursuant to the standard UNE-EN ISO/IEC 1706— and at an international level —according to the Agreement of Recognition of Common Criteria Certificates (CCRA).

For cryptologic and TEMPEST certification, the Certification Body uses its own criteria and methodology.