How secure is a firewall, a smartcard chip or an operating system really? Manufacturer specifications answer this only to a limited extent, because marketing and verified properties are two different things. Common Criteria closes this gap: the standard has security claims about IT products verified by independent evaluation bodies using a uniform methodology. For procurement in sensitive areas, the certificate is often mandatory, and for everyone else it is a solid selection criterion.
What is Common Criteria?
Common Criteria for Information Technology Security Evaluation, or CC for short, is an international standard for evaluating the security properties of IT products, standardized as ISO/IEC 15408. It emerged in the 1990s from the consolidation of European and North American evaluation catalogs and has been maintained internationally ever since.
Three terms structure every evaluation: the Target of Evaluation is the product in a defined version and configuration. The Security Target describes which security functions the product is meant to deliver and under which assumptions. Protection Profiles define vendor-independent requirement catalogs for entire product classes, such as firewalls or signature cards, and thereby make certificates comparable.
Thanks to mutual recognition agreements, certificates are valid across national borders. In Germany, the Federal Office for Information Security (BSI) certifies on the basis of the evaluation reports of accredited evaluation bodies. At the European level, the EUCC certification scheme continues the CC methodology within the framework of the Cybersecurity Act.
How it works
The path to certification follows a clearly regulated process:
- Defining security requirements: In the Security Target, the manufacturer describes the range of functions, the operating environment and the threats the product protects against. A recognized protection profile often serves as the basis.
- Choosing the depth of evaluation: The Evaluation Assurance Levels EAL1 through EAL7 determine how thoroughly the product is examined. EAL1 confirms basic functional tests, intermediate levels require insight into design and development processes, and the highest levels demand partly formal, mathematically supported proofs. For commercial software, EAL4 is a common ceiling, while chip cards and security modules regularly reach higher levels.
- Evaluation by the testing body: An accredited, independent evaluation body tests the product against the requirements. In addition to function, the evaluation also covers documentation, delivery channels and resistance to attacks of a defined effort, including penetration tests.
- Certification by the national body: The certification body, the BSI in Germany, assesses the evaluation report and issues the certificate. It applies exclusively to the tested version in the tested configuration.
- Maintaining the certificate: Updates and new versions require a reassessment or a regulated procedure for continuation. Without maintenance, a certificate becomes outdated along with the product.
Why it matters
- Objective comparability: certificates based on the same protection profile make products from different manufacturers comparable by a uniform standard instead of weighing data sheets against each other.
- Access to regulated markets: authorities and operators of sensitive infrastructure require certified components for certain product classes, for example in signature technology, smart metering or components for classified information.
- Trust in the supply chain: the evaluation includes the development environment and delivery. This reduces the risk of manipulated or sloppily built products.
- Reduced in-house effort: whatever an accredited evaluation body has already verified does not have to be tested again to the same depth by your own organization during the selection process.
- Knowing the limits: the certificate evaluates a product; secure operation must be ensured by the organization using it. A misconfigured certified firewall protects no better than an uncertified one.
Typical scenarios
A federal agency procures VPN gateways to connect branch offices. The tender requires certification against a specific protection profile, which narrows the field of bidders to tested products and makes the award legally defensible.
A manufacturer of smartcard chips has its platform evaluated at a high EAL level because bank cards and official documents cannot be approved without this foundation. The certification runs over months in parallel with development.
A company uses CC certificates as a criterion in product selection: given two comparable network components, the evaluated product is preferred, and the tested configuration serves at the same time as a template for hardening in the company's own operations.
Common Criteria vs. ISO 27001
The two standards are frequently confused but examine different things. Common Criteria evaluates a product: a specific version with defined security functions at the time of evaluation. ISO 27001 certifies an organization: a management system for information security with processes, roles and continuous improvement.
This leads to a division of labor. An ISO 27001 certificate says nothing about the quality of individual products in use, and a CC certificate says nothing about the maturity of operations. In practice, the two interlock: an ISMS based on ISO 27001 defines requirements for procurement, and CC-certified components provide solid building blocks for it, complete with documented security assumptions.
KAEMI as your partner
KAEMI weighs certifications where they carry decisions: in the selection of components for secure enterprise networks. As part of the Professional Services , KAEMI supports tender criteria, the classification of protection profiles and EAL levels, and the alignment of the certified configuration with the planned use. This way, tested products feed into an architecture whose operation actually upholds the security assumptions. For an assessment of your requirements, reach us via the contact page .