The Technology Assurance Assessment (TAAF) Framework by the MDIA is a tiered framework designed to provide varying degrees of technological assurances for a wide range of technologies, from emerging to traditional, aligning with international standards and industry best practices.
TAAF is scalable, allowing seamless integration of new technologies. It is targeted towards owners or operators of technology solutions, who want to assess and obtain recognition for their technology-related controls.
TAAF’s Official Recognition aims to provide varying degrees of confidence for stakeholders like Lead Authorities, investors, developers, suppliers, end-users, and the public. The framework is flexible, allowing applicants to choose what they want to be assessed against, with different assessment levels building on each other for higher trust levels.
Level 0
Self-Assessment (sector specific).
Level 1
Technology Control Design Review.
Level 2
Technology Control Effectiveness Review.
Level 3
Technology Audit.
While TAAF can be applied to any software-based technological solution, it is also able to focus on specific technology domains:
TAAF looks at controls to keep in line with international information security frameworks, including:
The MDIA provides official recognition depending on the Assessment Levels undertaken:
Acknowledgment
Denotes participation at TAAF Level 0 (Self-Assessment).
Recognition
Verifies undergoing of Technology Review at TAAF Level 1 or 2.
Certification
Provided for technology solutions that successfully undergo a TAAF Level 3 assessment.
| Level 0 | Level 1 | Level 2 | Level 3 | |
|---|---|---|---|---|
| Assessor | Applicant | Technical Expert | Systems Auditor | |
| Methodology | Self-Assessment | Technology Review | Assurance Assessment (ISAE3000) | |
| Technology Domains | Sector Specific |
|
||
| Control Types | Specific to each Initiative |
|
||
| Due Diligence | Monitoring | Prior to Onboarding | ||
| IDPS Blueprint | Not required | Required | ||
| Risk Level | Low | Medium | High | |
| Nature of Assessment | Questionnaire | Technology Review Report | ISAE 3000 | |
| Assessment Scope | Maturity Assessment | Control Design | Control Design & Operational Effectiveness |
|
| Level 0 | |
|---|---|
| Assessor | Applicant |
| Methodology | Self-Assessment |
| Technology Domains | Sector Specific |
| Control Types | Specific to each Initiative |
| Due Diligence | Monitoring |
| IDPS Blueprint | Not required |
| Risk Level | Low |
| Nature of Assessment | Questionnaire |
| Assessment Scope | Maturity Assessment |
| Level 1 | |
|---|---|
| Assessor | Technical Expert |
| Methodology | Technology Review |
| Technology Domains |
|
| Control Types |
|
| Due Diligence | Prior to Onboarding |
| IDPS Blueprint | Required |
| Risk Level | Medium |
| Nature of Assessment | Technology Review Report |
| Assessment Scope | Control Design |
| Level 2 | |
|---|---|
| Assessor | Technical Expert |
| Methodology | Technology Review |
| Technology Domains |
|
| Control Types |
|
| Due Diligence | Prior to Onboarding |
| IDPS Blueprint | Required |
| Risk Level | Medium |
| Nature of Assessment | Technology Review Report |
| Assessment Scope | Control Design & Operational Effectiveness |
| Level 3 | |
|---|---|
| Assessor | Systems Auditor |
| Methodology | Assurance Assessment (ISAE3000) |
| Technology Domains |
|
| Control Types |
|
| Due Diligence | Prior to Onboarding |
| IDPS Blueprint | Required |
| Risk Level | High |
| Nature of Assessment | ISAE 3000 |
| Assessment Scope |
|
For more information, please review the TAAF guidelines by clicking this link.
TAAF is targeted towards owners and operators of technological solutions, who want to undergo a review of their technology controls and obtain official recognition by a National Authority.
Finding the right Assessment Level depends on your objectives as a technology solutions owner or operator.
Technology review programmes offered by the MDIA are largely compatible with TAAF at different assessment levels:
You may find the list of Systems Auditors here.
You may find the list of Technical Experts here.
The MDIA is inviting stakeholders from the industry to submit their feedback on the proposed TAAF Framework.
As part of this public consultation, three (3) documents are being released:
Feedback is to be submitted on taaf@mdia.gov.mt between the 19th of May 2023 and the 30th of June 2023.
