The NIS Directive requires the implementation of performatively defined security standards in the field of cybersecurity. The compliance logic, in this case, leads to a high demand for both audit and certification services between private and public baseline administrators, allowing official confirmation of compliance of the solutions with the regulatory requirements. The Cyber Security Act introducing a European certification system is now freshly responding to this request. The presentation will focus on the logic of the act and on the current state of its implementation. Particular attention will be paid to the critical review of upcoming certification schemes (systems), the functioning of national CABs in the small Member States, and the scope for an independent national solution in cybersecurity and related areas.