In this extended abstract, we outline an approachfor security certification of products or services for moderncommercial systems that are characterized by agiledevelopment, the integration of development and operations,and high dynamics of system features and structures. Theproposed scheme rather evaluates the processes applied indevelopment and operations than investigates into the validityof the product properties itself. We argue that the resultingclaims are still suitable to increase the confidence in the securityof products and services resulting from such processes.