Axis 14: Certification (preliminary)
Note: This chapter describes plans for Phase 3 (Q2–Q4 2027). The certification suitability outlined here is intended or planned. Achieving it is dependent on community success and acceptance of the GCBoK. At the present time (2026), no one can seriously predict this.
Goal
To establish a certification scheme for Git-native compliance based on the GCBoK that meets the structural requirements of ISO/IEC 24773 (BoK as the basis for certification schemes) — provided the community adopts the GCBoK as a normative reference standard.
Material sources for the certification scheme (intended)
For building the certification programs, the two GCC strands provide the material:
- GCC (organization/compliance practice): articles of association/§ 60a framework, activities, projects, funding — as well as the experience reports/lessons learned of the GCC website as technical facts (theming, i18n, rendering contracts) without marketing claims.
- GCBoK (body of knowledge): axis/competency structure, learning outcomes, assessment criteria and competency levels — see the competency groups of this axis.
It is intended to map these sources systematically onto the competency groups and to include the experience reports as application examples in the assessment criteria.
Status: intended/planned — no existing program. Certificates will only be offered after successful development (Phase 3) and community acceptance; there is no entitlement to certification.
ISO/IEC 24773 — structural requirements (brief overview)
ISO/IEC 24773 defines how a Body of Knowledge (BoK) must be structured so that it can serve as the basis for certification schemes. Core requirements:
| Level | ISO/IEC 24773 term | GCBoK equivalent (status) |
|---|---|---|
| 1 | Knowledge Areas (KAs) | 14 axes (01–14) — present |
| 2 | Competencies per KA | intended — to be defined per axis |
| 3 | Learning Outcomes | planned — measurable learning objectives per competency |
| 4 | Assessment Criteria | intended — assessment standards for examinations |
| 5 | Professional Roles | planned — role assignment (e.g. Compliance Engineer, Auditor) |
| 6 | Competency Levels | intended — levels (Entry / Practitioner / Expert) |
Planned approach (Phase 3, Q2–Q4 2027)
1. Competency definition per axis (intended)
For each of the 14 axes, 2–4 competencies are to be formulated. Example (Axis 02 — Concepts):
| Competency ID | Title (working title) | Description (planned) |
|---|---|---|
GCBOK-02-C1 |
Apply V7GUID classification | Deterministically assign L1–L6 hierarchy + extended identifier fields (RepositoryId, ProcessTypeId, GatewayId, VariantId) |
GCBOK-02-C2 |
Construct evidence chains | Build prev_sha256 chaining, GPG signatures, V7GUID evidence chains for GoBD proofs |
GCBOK-02-C3 |
Validate cryptographic evidence chain | Verify Git commit hash + GPG signature + V7GUID as O(1) verifiability |
1a. New competency group — onboarding, chat workflow and harness (possible pilot)
The topics of the current AFJD/GCUV onboarding prototype are noted as a possible competency group for later partner assessments:
| Competency ID | Title (working title) | Description (planned) |
|---|---|---|
GCBOK-05-C4 |
Audit-proof KMU onboarding | Capture an existing workspace as a legal tenant/group OU and equip it with Git baseline, identity and recovery structure before migration |
GCBOK-03-C4 |
Chat workflow and agent protocol | Map specifications, questions, answer options, answers, decisions, tool actions, artifacts and gates as chat-workflow-1.0 |
GCBOK-04-C4 |
Deterministic harness gates | Correctly execute schema, SHA, policy, test, HITL, write and commit gates and recognize blocking states |
GCBOK-02-C4 |
Recoverable migration | Create checkpoints, state comparisons and restore plans; document corrections without history rewrite |
GCBOK-06-C4 |
Domain module handover | Hand over onboarding results to ledger, DMS, portfolio and other GitCover modules via references |
This group is a planning status, not recognition, accreditation or certification.
2. Learning outcomes per competency (planned)
Per competency, 2–3 measurable learning outcomes (Bloom's taxonomy: Remember → Create).
Example GCBOK-02-C1:
| LO ID | Formulation (planned) | Bloom level |
|---|---|---|
GCBOK-02-C1-LO1 |
Be able to explain the six hierarchy levels (L1–L6) and their 4-bit width | Understand |
GCBOK-02-C1-LO2 |
Determine the correct class notation (L1_L2_L3_L4_L5_L6) for a given evidence record |
Apply |
GCBOK-02-C1-LO3 |
Recognize and correct an incorrect V7GUID classification using the dictionary rules | Analyze |
Exemplary learning outcomes for GCBOK-05-C4 (planned)
| LO ID | Formulation (planned) | Bloom level |
|---|---|---|
GCBOK-05-C4-LO1 |
Distinguish legal tenant, group/OU top and affiliated companies | Understand |
GCBOK-05-C4-LO2 |
Create Git repo, .gitcover/, baseline snapshot and recovery point before a migration |
Apply |
GCBOK-05-C4-LO3 |
Perform a migration traceably via chat workflow, HITL gate, validation gate and checkpoint | Create |
GCBOK-05-C4-LO4 |
Restore a previously confirmed state via a restore plan and verify integrity | Analyze |
3. Assessment Criteria (intended)
| Criterion | Description (intended) |
|---|---|
| Theoretical examination | Multiple-choice / short answer on concepts, definitions, standards |
| Practical exercise | In a test Git environment: generate V7GUID, create sidecar, validate evidence chain |
| Case study | Solve a given compliance scenario (e.g. GoBD annual financial statement) using GCBoK tools |
4. Professional Roles Mapping (planned)
| Role | Relevant axes (example) | Certification level (intended) |
|---|---|---|
| Compliance Engineer | 01, 02, 04, 05, 06 | Practitioner |
| Git-native Auditor | 01, 02, 05, 07, 14 | Expert |
| Developer (GitCover Stack) | 02, 03, 04, 06 | Entry → Practitioner |
| PMO / Governance Lead | 01, 05, 07, 10, 14 | Practitioner → Expert |
5. Competency Levels (intended)
| Level | Designation | Prerequisites (intended) |
|---|---|---|
| Entry | Basic understanding | Theoretical examination passed; GCBoK chapters 01–06 read |
| Practitioner | Application competency | Entry + practical exercise + 1 case study; at least 1 year of project experience |
| Expert | Design competency | Practitioner + several case studies; community contribution (PRs, reviews, translations); at least 3 years of experience |
Possible partner certification path (planning)
For GitCover partners, a practice-oriented assessment could later be provided:
- Onboarding Readiness: repo bootstrap, legal tenant/OU model and baseline.
- Workflow Literacy:
chat-workflow-1.0, dialogues, decisions and sources. - Harness Operation: deterministic guards, HITL and write gates, validation.
- Migration Evidence: checkpoints, SHA manifests, sidecars and restore plan.
- Module Handover: handover to ledger/DMS/portfolio without loss of provenance.
- Review: independent assessment of an anonymized case by examiners/reviewers.
The assessment would be a possible certification proposal. It replaces neither an accreditation nor an independent technical, tax or legal review.
Dependencies and risks
| Factor | Influence on certification |
|---|---|
| Community acceptance | Without broad use of the GCBoK as a reference work, there is no demand for certification |
| Tool maturity | Webstatic, OPA, OSCAL tooling must be stable and documented |
| Partner ecosystem | BSI/ENISA partnerships (roadmap Phase 3) as credibility anchors |
| Legal framework conditions | Certification schemes in DE/EU require accreditation (DAkkS or similar) |
Next steps (preliminary)
- Obtain community feedback (Gitea issues, discussions) — is there demand?
- Develop and review pilot competencies for 2–3 axes (e.g. 02, 04, 05)
- Learning outcome workshop with potential trainers/examiners
- Assessment tooling as a prototype (webstatic-based? OSCAL export?)
- Decision: pursue further only with positive community feedback
References
- ISO/IEC 24773:2019 — Software and systems engineering — Certification of software and systems engineering professionals
- GCBoK Chapter 00 (Index) — positioning as BoK
- GCBoK Chapter 10 (Roadmap) — Phase 3: certification scheme (ISO/IEC 24773)
- GCBoK Chapter 11 (Reference GCC) — non-profit status and normative authority