On 24 May 2024, the Department for Energy Security and Net Zero (DESNZ) confirmed that the Commercial Product Assurance (CPA) Scheme Ownership would transfer from the National Cyber Security Centre (NCSC) to the SEC Security Sub-Committee (SSC) and placed a SEC obligation on the SSC to procure a CPA Scheme Operator. The CPA Scheme provides Manufacturers with a method to have their smart metering Device CPA certified. This ensures that the security claims made about their product can be independently verified.
Following a competitive procurement, CyTAL UK Ltd has been appointed by SECCo as the new CPA Scheme Operator. A knowledge transfer process between NCSC and CyTAL is underway.
CyTAL will not be accepting new CPA enquiries until the outcome of the current DESNZ consultation on the Transitional Approach Document v2 which closes on 08 January 2025. Until then, NCSC will continue to accept new CPA evaluation enquiries and will review and support all in-flight evaluations.
Subject to the outcome of the consultation, CyTAL will accept new evaluation enquiries from mid-January 2025. CyTAL and NCSC will be dual-running in-flight evaluations until the end of March 2025. The transition is expected to be fully completed by April 2025; further information will be shared in due course.