Cloud-centric services are becoming the norm in modern IT and Operational Technology (OT) platforms, where cybersecurity risks are also on the rise. The evolving regulatory landscape within Europe, exemplified by the Network and Information Security 2 (NIS2) directive and the Cyber Resilience Act (CRA), further amplifies the necessity for rigorous compliance measures. The presumption of conformity for platforms certified under EU-recognized certification schemes, as outlined by the CRA, is anticipated to promote the certification of IT and OT platforms. Nevertheless, the certification process for these platforms is challenging due to the complexity of cloud architectures and the constantly evolving threats, which require continuous adaptation. Furthermore, both NIS2 and CRA introduce new mandates, including the obligation to manage risks, report incidents to relevant authorities, inform customers about vulnerabilities, and provide relevant mitigation strategies. Consequently, there exists an urgent demand for tools and frameworks that support sustained certification in the cloudification of IT/OT platforms. This paper introduces the Continuous Certification Readiness Framework (CCRF), which is engineered to automate tasks related to certification preparation and support ongoing compliance assessments, thereby enabling organizations to effectively manage risks and uphold a high level of assurance within their cloud environments.

Despite growing efforts and encouraging successes in recent decades, fully formally verified projects are still rare in the industrial landscape. The industry often lacks the tools and methodologies to efficiently scale the proof development process. In this work, we give a comprehensible overview of the proof development process for proof developers and project managers. The goal is to support proof developers by rationalizing the proof development process, which currently relies heavily on their intuition and expertise, and by facilitating communication with the management line. To this end, we concentrate on the aspect of proof manufacturing and highlight the most significant sources of proof effort. We propose means to mitigate the latter through proof practices (proof structuring, proof strategies, and proof planning), proof metrics, and tools. Our approach is project-agnostic, independent of specific proof expertise, and computed estimations do not assume prior similar developments. We evaluate our guidelines using a separation kernel undergoing formal verification, driving the proof process in an optimised way. Feedback from a project manager unfamiliar with proof development confirms the benefits of detailed planning of the proof development steps, clear progress communication to the hierarchy line, and alignment with established practices in the software industry.