Axis 14: Certification (provisional)
Note: This chapter describes plans for Phase 3 (Q2–Q4 2027). The certification capabilities outlined here are envisaged or planned. Their achievement depends on community success and adoption of the GCBoK. At the present time (2026) no one can seriously predict this.
Objective
To establish a certification scheme for Git-native compliance based on the GCBoK that meets the structural requirements of ISO/IEC 24773 (BoK as a basis for certification schemes) — provided the community adopts the GCBoK as a normative reference standard.
ISO/IEC 24773 — Structural Requirements (Brief Overview)
ISO/IEC 24773 defines how a Body of Knowledge (BoK) must be structured to serve as a basis for certification schemes. Key requirements:
| Level | ISO/IEC 24773 Term | GCBoK Equivalent (Status) |
|---|---|---|
| 1 | Knowledge Areas (KAs) | 14 Axes (01–14) — present |
| 2 | Competencies per KA | envisaged — define per axis |
| 3 | Learning Outcomes | planned — measurable learning objectives per competency |
| 4 | Assessment Criteria | envisaged — evaluation criteria for examinations |
| 5 | Professional Roles | planned — role mapping (e.g. Compliance Engineer, Auditor) |
| 6 | Competency Levels | envisaged — levels (Entry / Practitioner / Expert) |
Planned Approach (Phase 3, Q2–Q4 2027)
1. Competency Definition per Axis (envisaged)
For each of the 14 axes, 2–4 competencies shall be formulated. Example (Axis 02 — Concepts):
| Competency ID | Title (working title) | Description (planned) |
|---|---|---|
GCBOK-02-C1 |
Apply V7GUID Classification | Deterministically assign L1–L6 hierarchy + extended fields (RepositoryId, ProcessTypeId, GatewayId, VariantId) |
GCBOK-02-C2 |
Construct Evidence Chains | Build prev_sha256 chains, GPG signatures, V7GUID evidence chains for GoBD evidence |
GCBOK-02-C3 |
Validate Cryptographic Evidence Chain | Verify Git commit hash + GPG signature + V7GUID as O(1) verifiability |
2. Learning Outcomes per Competency (planned)
Per competency 2–3 measurable learning outcomes (Bloom taxonomy: Remember → Create).
Example GCBOK-02-C1:
| LO ID | Formulation (planned) | Bloom Level |
|---|---|---|
GCBOK-02-C1-LO1 |
Explain the six hierarchy levels (L1–L6) and their 4-bit width | Understand |
GCBOK-02-C1-LO2 |
Determine the correct class notation (L1_L2_L3_L4_L5_L6) for a given document |
Apply |
GCBOK-02-C1-LO3 |
Recognise and correct a faulty V7GUID classification using dictionary rules | Analyze |
3. Assessment Criteria (envisaged)
| Criterion | Description (envisaged) |
|---|---|
| Theoretical Examination | Multiple-choice / short answer on concepts, definitions, standards |
| Practical Exercise | In a test Git environment: generate V7GUID, create sidecar, validate evidence chain |
| Case Study | Solve a given compliance scenario (e.g. GoBD annual accounts) using GCBoK means |
4. Professional Roles Mapping (planned)
| Role | Relevant Axes (example) | Certification Level (envisaged) |
|---|---|---|
| Compliance Engineer | 01, 02, 04, 05, 06 | Practitioner |
| Git-native Auditor | 01, 02, 05, 07, 14 | Expert |
| Developer (GitCover Stack) | 02, 03, 04, 06 | Entry → Practitioner |
| PMO / Governance Lead | 01, 05, 07, 10, 14 | Practitioner → Expert |
5. Competency Levels (envisaged)
| Level | Designation | Prerequisites (envisaged) |
|---|---|---|
| Entry | Basic understanding | Theoretical exam passed; GCBoK chapters 01–06 read |
| Practitioner | Practitioner competence | Entry + practical exercise + 1 case study; min. 1 year project experience |
| Expert | Designer competence | Practitioner + multiple case studies; community contribution (PRs, reviews, translations); min. 3 years experience |
Dependencies and Risks
| Factor | Impact on Certification |
|---|---|
| Community Adoption | Without broad use of GCBoK as a reference work, no demand for certification |
| Tool Maturity | Webstatic, OPA, OSCAL tooling must be stable and documented |
| Partner Ecosystem | BSI/ENISA partnerships (Roadmap Phase 3) as credibility anchors |
| Legal Framework | Certification schemes in DE/EU require accreditation (DAkkS etc.) |
Next Steps (provisional)
- Gather community feedback (Gitea Issues, Discussions) — is there demand?
- Develop pilot competencies for 2–3 axes (e.g. 02, 04, 05) and review
- Learning outcome workshop with potential trainers/examiners
- Prototype assessment tooling (webstatic-based? OSCAL export?)
- Decision: Proceed only with positive community response
References
- ISO/IEC 24773:2019 — Software and systems engineering — Certification of software and systems engineering professionals
- GCBoK Chapter 00 (Index) — Positioning as BoK
- GCBoK Chapter 10 (Roadmap) — Phase 3: Certification Scheme (ISO/IEC 24773)
- GCBoK Chapter 11 (Reference GCC) — Non-profit status and normative authority