Baseline security requirements for the procurement of ICT products and services according to ENISA

Recently, ENISA has published version 1.0 of a document that seems highly interesting, title "Indispensable baseline security requirements for the procurement of secure ICT products and services" (link).

It is a document elaborated by a group of experts named by different Member States (in particualr, by Austria, France, Germany, Czech Republic, Spain, The Netherlands and Finalnd) that is applicalbe to service providers.

Before mapping security requirements listed in the ENISA document with LEET Security methodology, let us introduce some reflections about it:

1. We completely agree that some minimum security requirements should exist for every kind of component or device, to assure that there is no weakest link.
   Nevetheless it seems to us a bit dared to say that those elements that meet these requirements can be considered "secure" and those that do not, should be considered "insecure", because we will all agree that altough the minimum requirements are met, we cannot say that they are invulnerables (being in agreement that no device shoudl be allowed if do not meet the minimum security baseline).
2. Following that phylosophy, authors recognize that could be use cases where those minimum requirements are enough, but there could be others (most, in our opinion) in which additional requirements are going to be needed and the customer will have to assure that those additional requirements are met.
   In those cases, is where rating plays a key role because, once the minimum requirements are met, rating levels show how, over the minimum requirements, are security controls assessed during rating (something that is not achivable using management system certification according to ISO27001 - in fact, we could say that it is a necessarty but not enough condition).
3. Altough document is for products and services, in fact, 7 of 10 principles listed are for products, and only 3 are focused on services (quality management, UE jurisdiction and data usage restriction).
   For that reason, we wonder if could make sense to publish another document, as the one commented here, but mainly focused on services (more than on products).

Finally, and as promised, in the following table we have mapped minimum requirements of ENISA document with sections in LEET Security rating methodology, identifying also, what are the requirements in this methodolody for the minimum rating level (aka 'D D D'). Still considering that LEET Security is focused in services, not on products, we can see an overlap of more that 50% between both documents.