What Is the Certificate?

Common Criteria (ISO/IEC 15408) is an international framework for the independent evaluation of the security features of information technology products. Evaluation is carried out against the claims a product makes in its Security Target document, and the result is an Evaluation Assurance Level (EAL 1-7). Thanks to the Common Criteria Recognition Arrangement (CCRA), certificates are mutually recognised among participating countries.

Who Needs It?

Smart card, secure element and HSM manufacturers
Network security device (firewall, VPN) manufacturers
Operating system and database developers
IT product manufacturers within scope of public and defence procurement
Electronic ID and passport chip manufacturers

Is It Mandatory?

Generally not mandatory; it is often required in public and defence procurement. In some sectors (e.g. payment cards, electronic ID) it is effectively mandatory. Evaluation is carried out at an accredited laboratory, and the certificate is issued by the national scheme authority.

Scope of the Standard

Defining the Target of Evaluation (TOE) and its boundaries
Selecting a Protection Profile (PP) or preparing a Security Target (ST)
Security functional requirements (SFRs): authentication, access control, cryptographic support, audit, data protection
Security assurance requirements (SARs): development, guidance documents, life-cycle support, testing, vulnerability assessment
Evaluation Assurance Levels (EAL 1-7) and the rationale for the choice
Vulnerability analysis and penetration testing (deepening with the level)
Evaluation at an accredited laboratory (ITSEF)
Certification by the national scheme authority
Certificate maintenance and assessment of product updates

Certification Process

1Application and Product DescriptionThe product family, model list, technical specifications and target market are determined. The applicable standard and certification route become clear at this step.
2Technical File ReviewDesign documents, the bill of materials, critical-component certificates and the instructions for use are examined.
3Product TestingThe tests the relevant standard requires are carried out. The test report is the fundamental basis for the certification decision.
4Factory AuditIf the scheme requires it, the continuity of manufacturing and factory production control (FPC) are verified on site.
5Issuing the Certificate and MarkingOnce conformity is verified, the certificate is issued; the marking rules for the product and packaging are applied.
6Follow-up AuditsDepending on the scheme, periodic factory audits and/or follow-up testing on samples taken from the market are carried out.

Period of Validity

The validity period varies by scheme: some product certificates are indefinite and rely on periodic factory audits, while some schemes (e.g. country market marks) require annual or per-shipment renewal. Every design change to the product requires the certificate to be reviewed.

Required Documents

The list of product models and variants
Technical drawings, diagrams and the bill of materials
Certificates for critical components
The instructions for use and a sample label
Existing test reports, if any
Production-site details

Certification Cost

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

The number of models and variants in the product family
The test scope the applicable standard requires
Whether a factory audit is required
The number of target markets and whether each requires separate testing
Whether existing test reports can be accepted

Accreditation

Product certification is carried out under ISO/IEC 17065; The tests that form the basis for certification are carried out in laboratories with ISO/IEC 17025 accreditation. The two scopes are separate. Recognition between accreditation bodies is provided through IAF and ILAC agreements.

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

Scope and authorisations

Related Certifications

Frequently Asked Questions

Is a product with a higher EAL more secure?

Not necessarily. The EAL shows how rigorously the security claim was evaluated, not how broad the claim itself is. A high EAL obtained against a narrow Security Target can mean less protection than a lower EAL obtained against a broad one. The Security Target document should be read when comparing products.

What is a Protection Profile (PP)?

It is a standardised set of security requirements for a specific product class. Evaluations carried out with a claim of conformance to a PP provide comparability between products; mutual recognition under the CCRA also relies heavily on PP-based evaluations.

Common Criteria Certification