For an organisation to become a CySPAG registered manufacturer, the organisation must submit a self-declaration (see Annex A) to the BSIA in sufficient detail for the BSIA to be able to accept the self-declaration.
 
The BSIA shall accept that self-declaration as a binding commitment from that organisation that the processes required to meet the requirements of the current version of BSIA Form 343 ‘Manufacturers of safety and security systems - Cybersecurity code of practice’ have been effectively implemented with regards to those products listed.
 
The BSIA will then raise an invoice for the full annual fee (see Annex B), once the invoice has been settled the BSIA will then recognise the organisation as a CySPAG registered manufacturer for the products listed on the self-declaration.
 
The BSIA will endeavour to activate the CySPAG manufacturers registration within 4 weeks of receipt of registration scheme payment.
 
The BSIA will reject those self-declarations that have not been completed correctly or do not clearly meet the requirements of BSIA Form 343 ‘Manufacturers of safety and security systems - Cybersecurity code of practice’. Feedback will be provided for any rejected self-declarations and where consensus is not possible between the organisation and the BSIA, the organisation can request that the self-declaration be reviewed by the CySPAG committee.