Three independent cybersecurity certifications built for the food industry — for the businesses that make our food, the technology they run on, and the way they defend it. Every certificate is reviewed by CSAFI and decided by an independent panel, never by the firm that did the assessment.
In development · A pilot opens in early 2027 · Register interest now — there is nothing to buy yet
Recipes, temperatures, cleaning cycles and traceability all run on connected controls now. Regulators, buyers and insurers increasingly ask for evidence that those controls are protected. No private body can grant “NIS2 certified” or “CRA certified” status — so CSAFI offers the honest alternative: an independent, food-specific assessment, built to be handed over as evidence.
Show regulators, retailers and insurers that your cybersecurity has been independently checked against requirements written for food production — not for a bank or an office.
Show food customers that a controller, machine or software product is ready for the EU Cyber Resilience Act — one review instead of many security questionnaires.
Ask for a CSAFI certificate by name in purchasing specifications. Every certificate will be listed in a public register, so anyone can check its status before relying on it.
Each certification is built on the same skeleton (NIST CSF 2.0), with requirements specific to the framework it is aligned with. Choose one, or combine them.
For food manufacturers, processors and wholesalers — and their suppliers
An independent assessment of how a food business manages cyber risk, from the boardroom to the plant floor, against requirements aligned with the EU NIS2 Directive.
For makers of food equipment, packaging machines, sensors and food software
An independent review of a manufacturer’s product-security processes, and a sample product version, against the essential requirements of the EU Cyber Resilience Act.
For food sites running TACCP for BRCGS, FSSC 22000, IFS, SQF or FSMA
Applies the PAS 96:2026 threat-assessment (TACCP) approach to cyber and operational-technology threats — the cyber input food defence audits ask for, but do not define.
The same impartial rules: approved assessors and laboratories, a CSAFI quality review of every report, an independent decision panel, and published complaints and appeals.
“Aligned with” means every requirement traces to that framework. A CSAFI certificate is not a declaration of legal compliance with it.
Cyber Resilience and Food Defence – Cyber come in three tiers, so a small site can start small and go deeper later. Results from ISO/IEC 27001, IEC 62443 and similar audits can be reused to avoid duplicate work.
A verified self-assessment: your answers and evidence, desk-reviewed by an approved partner firm. Renewed every year.
A remote audit by an approved partner firm, typically one to two days.
An on-site plant assessment with technical testing, three days or more — passive-first, with the plant able to stop the work at any time.
Product Security Readiness has its own three stages: a triage and classification check, a process readiness review, and a product evidence review with laboratory testing.
Every certification follows the same twelve steps. Each step has one owner and a deadline, so no file stalls and no step is skipped.
You apply online. CSAFI checks the scope, screens for conflicts of interest, confirms an approved assessor or laboratory, and signs the certification agreement with you.
An approved partner firm reviews documents and, at the higher tiers, visits the plant — or a laboratory evaluates the product. Findings are graded and closed within fixed deadlines.
A CSAFI reviewer who had no part in the audit checks every report. An independent panel — nobody from the firm that did the work — then decides, and the certificate is listed publicly.
A yearly check keeps a certificate alive, and it is renewed before it expires. A product certificate is kept current through change and patch notices.
The person who assesses, the one who reviews, the panel that decides and the office that issues are always different people — the core rule of ISO/IEC 17065, the international standard for certification bodies.
Industry auditors and professionals who have contributed to published standards, drawn from around the world. The IACC approves the requirements, oversees the assessors and laboratories, hears appeals, and supplies the independent panels that decide each certificate.
Qualified lead auditors
ISO/IEC 27001 or GFSI-recognised scheme auditors with current registration — they know what good audit evidence looks like.
Industrial automation and OT security specialists
Plant networks, PLCs and machines are the heart of both schemes; at least one has product security evaluation experience.
Food manufacturing and food safety professionals
HACCP and TACCP experience — they keep requirements realistic for a production line and link cyber findings to food safety.
Contributors to published standards
People who have contributed to ISO, IEC, national or regional standards bodies.
Legal and regulatory specialists
Certification law, product liability and data protection — certificates carry legal weight.
Members are appointed by CSAFI’s governing body for three-year terms. Each one signs a confidentiality undertaking and declares their interests.
We are looking for lead auditors, OT security specialists, food safety professionals, standards contributors and legal specialists who want to help make food production safer. You do not need to be a CSAFI member.
The programme is being built in the open. These dates are planned and may move.
November 2026
Register interest and apply for the pilot.
Dec 2026 – Mar 2027
Requirements for each certification, auditor competence, grading, appeals and the rules for the CSAFI mark.
Q1–Q2 2027
A small group of companies goes through the scheme, with every report quality-checked by CSAFI.
Q2–Q3 2027
The Foundation and Verified tiers open to everyone, with a public register of certificates.
Late 2027 onwards
CSAFI applies to a national accreditation body — a process that typically takes 12 to 24 months.
There is nothing to buy yet. Certificates will not be sold until the scheme rules, contracts and data-protection terms are in place.
Tell us who you are and the CSAFI team will be in touch about the pilot and what certification would involve for you.
Join the pilot for Cyber Resilience or Food Defence – Cyber.
Get a controller, machine or software product ready for the Cyber Resilience Act.
Become an approved partner firm or laboratory. Both must be CSAFI members.
Recognise the CSAFI certificate, or write it into your supplier requirements.
Register interest and the CSAFI team will talk you through what the pilot would involve for your site, your product or your organisation.
CSAFI certifications are independent industry assessments. They are not regulatory approvals, do not replace a company’s legal obligations, and are not EU conformity assessments or CE marking. CSAFI is not a notified body, and CSAFI certificates are not accredited. PAS 96 is published by BSI; CSAFI is not affiliated with BSI.
