Common Criteria (IC3S)

Who Needs This Service

Vendors of firewalls, HSMs, smart cards, operating systems, VPN and encryption products and other IT security products selling to governments and enterprises need this.

Startups with security products benefit.

Buyers specify Common Criteria in tenders.

If you only need ISO 27001, that is a different scheme.

Key Benefits

• CCRA-recognised certification
• Security Target prepared
• CCTL coordination
• Certified products list
• Government and export credibility

Next Steps & Related Services

After certification, maintain the product. Related services: STQC certification, Information Security Testing and NCCS certification.

Common Mistakes

• Weak Security Target.
• Wrong EAL.
• Late evidence.
• Ignoring guidance D06.
• Unlicensed lab.

Timeline, Costs & Practical Tips

Evaluation takes time.

Practical tip: choose the EAL needed by buyers.

Additional Information

Common Criteria is a global standard for security evaluation.

Practical Scenarios

Scenario 1:

A firewall vendor certifies.

Scenario 2:

A smart card vendor certifies.

Scenario 3:

A startup prepares an ST.

Process & Planning

A Common Criteria plan begins with choosing the assurance level (EAL1 to EAL4) that your buyers need. Prepare the Security Target or Protection Profile, collect development and testing evidence, sign a contract with a licensed CCTL, and apply to the certification body using the IC3S guidance to applicants (D06). The CCTL evaluates, STQC validates the report and issues the certificate and certification report. Planning checklist: scope the target of evaluation tightly, keep documentation consistent, plan for evaluator questions and consider maintenance of the certificate when you update the product.