Do business safely
A rigorous and transparent cybersecurity labelling methodology
The rating guide details the procedures and more than 1,300 practices analysed to determine the rating of the security levels provided by the suppliers in each service.
The methodology is based on a supervised self-assessment, which assumes that it is the ICT service provider itself that chooses the level at which it wishes to qualify its service. To do this, you must complete a report setting out how you comply with the practices required for that level. This report is then audited by LEET Security to verify that the proposed level is appropriate.
The rating methodology is the first to comply with the standard "UNE 71381:2016 Information technology. Cloud Computing. Labelling systems" which establishes the requirements that labelling systems such as LEET Security must meet.
Procedure
The procedure, after acceptance of the conditions by the supplier, is carried out in the following phases:
-
Preparation
Training of supplier on the rating scheme and its components as well as the stages of the process.
-
Registration
Once the report has been received from the supplier, it is assessed in detail and subjected to a partial audit; additional information is requested if necessary, and the resulting score is assigned as the service rating.
-
Monitoring
Throughout the one-year validity period of the certification, LEET Security monitors market trends, incidents, etc., that could alter the rating. During this period, the service may be subject to random, comprehensive audits.
-
Renovation
One year after qualifying, and by similar process, the renewal with the corresponding rating is granted or denied.
Rating
The ratings granted consist of 3 letters, which define the rating obtained by the provider for the given service, in the three fundamental dimensions of Confidentiality, Integrity and Availability of the information. All ratings are registered and made public on the LEET Security website and its broadcast channels.
Both the specific measures implemented by the provider in the rated service and the provider’s general characteristics are taken into account when awarding these rating levels, to ensure that the provider is reliable. The measures implemented to ensure the resilience of the service provided are also assessed (as no one is immune to incidents, the most important factor is to evaluate the service’s ability to recover).
Follow-up
Monitoring to ensure that the required conditions are maintained during the validity period is carried out based on three additional control mechanisms:
- Conducting random periodic audits.
- Digital surveillance, including reporting channel by users of qualified services.
- Obligation of the supplier to notify LEET Security of any circumstances or modifications that may affect the rating.
In any of these cases, LEET Security would proceed with a reassessment in order to determine whether to maintain or modify the rating levels granted to the service.
Rating levels
All the practices included in the rating guide are classified into 5 tiers, from A+ to D; requiring compliance with basic security measures from Level ‘D’ and corresponding Level ‘A+’ to the best possible set of measures at any given time. In this way, the ‘A+’ level is reserved for those services intended for the processing of extremely confidential information (such as industrial or national secrets) or with very demanding availability requirements (such as critical infrastructures).
To reach a certain level, it is necessary to comply with all the practices required for it, taking into account that “security is as strong as the weakest link”. This implies that if a service meets all Level C practices but fails one required for Level B, the final rating will be C.
Having the LEET Security seal ensures that the rated service has a management system and security measures.
This rating is not global; rather, the three fundamental dimensions of information security — Confidentiality, Integrity, and Availability — are individually evaluated. In this way, the rating granted by LEET Security consists of three letters: The first indicates the reliability of the service in terms of Confidentiality, the second assesses Integrity and the third measures Availability, always specifically for the qualified service.
Our rating system has also set a special benchmark for different standards. In this version of the methodology there are five special supplemental compliance qualifiers:
- +DORA
DORA Passport - indicating the degree of compliance with the requirements established by the European DORA (Digital Operational Resilience Act) regulation. It includes a Cyber Resilience Index, indicating the degree of implementation of cyber resiliency measures, between 0 and 1,000, in two levels, DORA Prime (between 500 and 749) and DORA Elite (between 750 and 1,000).
- +NIS2
NIS2 Passport - which provides a complete assessment of the requirements set out in NIS2.
- +PRIV
- is granted after verifying that all the practices linked to the data protection regulations are complied with, and in particular with the General Data Protection Regulation and the LOPDGDD, according to the rating obtained.
- +ENS/c
- indicating compliance with RD 311/2022, which regulates the National Security Scheme.
- +PCI
- implies that the service complies with PCI DSS.
We can also come across the non-specific rating: PASSED. This means that the service in question at least exceeds all of the measures corresponding to level D in all three dimensions, although the supplier does not want to show the levels explicitly. In this case, the executive report of the corresponding levels can be consulted in the Qualified Services section, associated with the corresponding registration number, or by clicking on the seal shown on the website of the service provider.
LEET Security's controls framework & Rating
The Framework gives you the most comprehensive checklist. With its 5 levels, it can be tailored to all organizations. You can see your level in each of the 73 sections. We then provide specific measures to help you improve.
You will have a comprehensive metric to understand your current situation and set goals to improve your level of protection.
Recognition
Developed since 2010 and continuously evolving, LEET Security’s rating system is recognized by the European Agency for Network and Information Security (ENISA) and is registered as a trusted instrument by Instituto Nacional de Ciberseguridad (INCIBE).
The rating methodology adheres to the standard UNE 71381:2016 Information technology. Cloud Computing. Labelling systems.
Do you want to know in detail what our methodology offers you?