They need to conform to rigorous guidance (instance research defense and you may security measures) included in the certification contract