The Technology Assessment Recognition Framework (TARF) by the MDIA is a tiered framework designed to provide varying degrees of recognition to a wide range of technologies, from emerging to traditional, aligning with international standards and industry best practices.
TARF is scalable, allowing seamless integration of new technologies. It is targeted towards owners or operators of technology solutions, who want to assess and obtain recognition for their technology-related controls.
TARF’s Official Recognition aims to provide varying degrees of confidence for stakeholders like Lead Authorities, investors, developers, suppliers, end-users, and the public. The framework is flexible, allowing applicants to choose what they want to be assessed against, with different assessment levels building on each other for higher trust levels.
Level 0
Self-Assessment (sector-specific).
Level 1
Technology Sandbox.
Level 2
Technology Review.
Level 3
Technology Assurance.
While TARF can be applied to any software-based technological solution, it is also able to focus on specific technology domains:
TARF looks at controls to keep in line with international information security frameworks, including:
The MDIA provides official recognition depending on the Assessment Levels undertaken:
Acknowledgment
Denotes participation at TARF Level 0 (Self-Assessment).
Mark of Credit
Verifies undergoing of Technology Review at TARF Level 1 or 2.
Certification
Provided for technology solutions that successfully undergo a TARF Level 3 assessment.
| Level 0 | Level 1 | Level 2 | Level 3 | |
|---|---|---|---|---|
| Assessor | Applicant | Technical Expert | Systems Auditor | |
| Methodology | Self-Assessment | Sandbox Programme | Technology Review | Reasonable Assurance Assessment (ISAE 3000) |
| Technology Domains | Sector Specific |
|
||
| Control Types | Specific to each Initiative |
|
||
| Due Diligence | Monitoring | Prior to Onboarding | ||
| IDPS Blueprint | Not required | Required | ||
| Nature of Assessment | Questionnaire | Programme-specific | Technology Review Report | ISAE 3000 |
| Assessment Scope | Maturity Assessment | Maturity Development |
|
|
| Level 0 | |
|---|---|
| Assessor | Applicant |
| Methodology | Self-Assessment |
| Technology Domains | Sector Specific |
| Control Types | Specific to each Initiative |
| Due Diligence | Monitoring |
| IDPS Blueprint | Not required |
| Nature of Assessment | Questionnaire |
| Assessment Scope | Maturity Assessment |
| Level 1 | |
|---|---|
| Assessor | Technical Expert |
| Methodology | Sandbox Programme |
| Technology Domains |
|
| Control Types |
|
| Due Diligence | Prior to Onboarding |
| IDPS Blueprint | Required |
| Nature of Assessment | Programme-specific |
| Assessment Scope | Maturity Development |
| Level 2 | |
|---|---|
| Assessor | Technical Expert |
| Methodology | Technology Review |
| Technology Domains |
|
| Control Types |
|
| Due Diligence | Prior to Onboarding |
| IDPS Blueprint | Required |
| Nature of Assessment | Technology Review Report |
| Assessment Scope |
|
| Level 3 | |
|---|---|
| Assessor | Systems Auditor |
| Methodology | Reasonable Assurance Assessment (ISAE 3000) |
| Technology Domains |
|
| Control Types |
|
| Due Diligence | Prior to Onboarding |
| IDPS Blueprint | Required |
| Nature of Assessment | ISAE 3000 |
| Assessment Scope |
|
For more information, please review the TARF guidelines by clicking this link.
TARF is targeted towards owners and operators of technological solutions, who want to undergo a review of their technology controls and obtain official recognition by a National Authority.
Finding the right Assessment Level depends on your objectives as a technology solutions owner or operator.
Technology review programmes offered by the MDIA are largely compatible with TARF at different assessment levels:
You may find the list of Systems Auditors here.
You may find the list of Technical Experts here.
As part of this public consultation, four (4) documents were released:
