Common Criteria (ISO/IEC 15408): EAL, CCRA, EUCC
Common Criteria for Information Technology Security Evaluation (CC) is published twice: by ISO/IEC as the ISO/IEC 15408 series (first edition 1999) with the companion methodology ISO/IEC 18045, and by the nations of the Common Criteria Recognition Arrangement (CCRA) as CC:2022 and CEM:2022. 2026 changed several things at once: ISO published new editions of every part in April and May, SOG-IS stopped issuing certificates on 27 February 2026 after the EU scheme EUCC took over, and the Cyber Resilience Act now points to European certificates for its critical products. This guide takes each point from the texts: the editions and transition dates, the EAL packages component by component, what the CCRA actually recognises, the current member list, the EUCC rules, and the claims that do not survive a reading of the sources. Related frameworks: CRA, RED 3.3, EN 303 645.
Key dates
Section titled “Key dates”| Date | Event | Source |
|---|---|---|
| 8 September 2014 | Current CCRA text (dated 2 July 2014) ratified | CCRA |
| 9 August 2022 | ISO/IEC 15408-1:2022 published (edition 4) | IEC catalogue |
| November 2022 | CC:2022 Release 1 and CEM:2022 published by the CCRA | CC:2022 Part 1 foreword |
| 20 April 2023 | CCRA transition policy to CC:2022 (CCMC-2023-04-001) | Transition policy |
| 27 February 2024 | EUCC Regulation (EU) 2024/482 enters into force (OJ of 7 February 2024, plus 20 days) | Art. 50 |
| 30 June 2024 | Last start date for an initial evaluation under CC v3.1 Release 5 | Transition policy |
| 8 January 2025 | First EUCC amendment, Regulation (EU) 2024/3144, in force | Reg. 2024/3144 |
| 27 February 2025 | EUCC applies; national CC schemes covered by EUCC cease to produce effects | Art. 49(1) and 50 |
| 19 March 2025 | CCRA and EUCC co-existence procedure (CCMC-011) issued | CCMC-011 |
| 31 December 2025 | Last start date for a CC v3.1 R5 product certification against a PP claiming exact conformance | Transition policy |
| 29 December 2025 | Second EUCC amendment, Regulation (EU) 2025/2462, in force | Reg. 2025/2462 |
| 27 February 2026 | Deadline to finish national-scheme certifications started before 27 February 2025; SOG-IS stops issuing certificates | Art. 49(2), SOG-IS website |
| 28 April 2026 | ISO/IEC 15408-5:2026 published (edition 2) | IEC catalogue |
| 19 May 2026 | ISO/IEC 15408-1, -2, -3 (edition 5), -4 (edition 2) and ISO/IEC 18045:2026 (edition 4) published; 2022 editions withdrawn | IEC catalogue |
| 11 June 2026 | CRA Chapter IV (notification of conformity assessment bodies) applies | CRA Art. 71 |
| 11 September 2026 | CRA reporting obligations (Article 14) apply | CRA Art. 71 |
| 11 December 2027 | CRA applies in full | CRA Art. 71 |
| 31 December 2027 | Last date for a CC:2022 Security Target claiming a CC v3.1 Protection Profile | Transition policy |
Two publications of one standard
Section titled “Two publications of one standard”ISO/IEC editions
Section titled “ISO/IEC editions”The IEC catalogue lists five editions of ISO/IEC 15408-1: 1999, 2005, 2009, 2022 and 2026. The 2022 series was the first to have five parts, and the CC:2022 foreword explains why: CC:2022 and CEM:2022 "were developed first as ISO/IEC standards and subsequently published by the CCRA as the new version". Earlier versions travelled the other way, from the CCRA nations to ISO. Part 4 and Part 5 were new in 2022; Part 5 is built from the package sections of CC v3.1 Release 5 Part 3.
| Part | Title | 2022 edition | 2026 edition |
|---|---|---|---|
| ISO/IEC 15408-1 | Introduction and general model | Ed. 4, 9 August 2022 (withdrawn 19 May 2026) | Ed. 5, 19 May 2026 |
| ISO/IEC 15408-2 | Security functional components | 2022 | Ed. 5, 19 May 2026 |
| ISO/IEC 15408-3 | Security assurance components | 2022 | Ed. 5, 19 May 2026 |
| ISO/IEC 15408-4 | Framework for the specification of evaluation methods and activities | 2022 (new part) | Ed. 2, 19 May 2026 |
| ISO/IEC 15408-5 | Pre-defined packages of security requirements | 2022 (new part) | Ed. 2, 28 April 2026 |
| ISO/IEC 18045 | Methodology for IT security evaluation (2026 title: Requirements and methodology for IT security evaluation) | 2022 | Ed. 4, 19 May 2026 |
CCRA version and transition
Section titled “CCRA version and transition”The Common Criteria Portal publications page, checked on 7 October 2026, lists CC:2022 Release 1 (five parts), CEM:2022, and errata and interpretations up to version 1.2, whose application it marks as mandatory. It does not list a CCRA release aligned with the 2026 ISO editions. The CCRA transition policy of 20 April 2023 sets the move from CC v3.1:
- CC v3.1 Release 5 is the last revision of v3.1. Initial evaluations on v3.1 R5 could start until 30 June 2024.
- Product certifications on v3.1 R5 against a PP or PP-Configuration claiming exact conformance could start until 31 December 2025.
- After 30 June 2024, re-evaluations and re-assessments based on v3.1 evaluations can start for up to 2 years from the initial certification date.
- A CC:2022 Security Target may claim a CC v3.1 Protection Profile until 31 December 2027.
- A CC:2022 certification may reuse v3.1 R5 ALC results and v3.1 R5 platform certificates in composition.
The portal also records the CCRA declaration that the assurance levels defined in different versions of the criteria are equivalent for composition.
What changed in CC:2022
Section titled “What changed in CC:2022”The CC:2022 Part 1 foreword lists the changes from v3.1: exact conformance as a third conformance type, removal of low assurance Protection Profiles and introduction of direct rationale PPs, multi-assurance evaluation, composition of assurance, new functional and assurance requirements, and the two new parts. Part 2 groups the functional classes FAU, FCO, FCS, FDP, FIA, FMT, FPR, FPT, FRU, FTA and FTP. Part 3 holds the assurance classes for Protection Profile evaluation (APE, ACE for PP-Configurations), Security Target evaluation (ASE), development (ADV), guidance (AGD), life cycle (ALC), tests (ATE), vulnerability assessment (AVA) and composition (ACO).
Objects of evaluation: TOE, TSF, ST, PP, cPP
Section titled “Objects of evaluation: TOE, TSF, ST, PP, cPP”Target of Evaluation (TOE). The product or part of a product being evaluated: hardware, software, firmware or a combination. The EUCC Regulation defines it as "an ICT product or part thereof, or a protection profile as part of an ICT process". Its boundary fixes what the certificate covers; the EUCC Regulation requires the certificate or certification report to state whether the whole product or only parts of it were certified (Article 10(2)).
TOE Security Functionality (TSF). The parts of the TOE that implement the security functional requirements. Design analysis, testing and vulnerability analysis apply to the TSF.
Security Target (ST). The product-specific document: TOE description, security problem definition (threats, organisational security policies, assumptions), security objectives, security functional requirements (SFRs), security assurance requirements (SAR), the TOE summary specification and the rationale linking them. The ST evaluation class (ASE) is part of every EAL package.
Protection Profile (PP). Implementation-independent requirements for a category of products. CC:2022 Part 1 defines three ways an ST or PP can conform to it: exact (the ST has the same security problem definition and objectives as the PP and the same SFRs, only with assignments and selections resolved), strict (a superset of the PP, where new assumptions do not weaken it) and demonstrable (statements equivalent to such a superset, allowed only when the PP permits it). Part 5 notes that an EAL cannot be augmented in an ST claiming exact conformance.
collaborative Protection Profile (cPP). A PP developed by an International Technical Community (iTC) endorsed by the CCRA Management Committee. Annex K of the CCRA limits cPP assurance components to EAL 2, unless the iTC shows that activities up to and including EAL 4 can be reproduced between schemes. The portal lists iTCs and position statements for application software, biometrics security, database management systems, dedicated security components, full disk encryption, hardcopy devices, network device fundamentals and firewalls, USB portable storage devices, and CC in the cloud.
| Level | Document | Product-specific | Role |
|---|---|---|---|
| Normative framework | ISO/IEC 15408 (parts 1 to 5) and ISO/IEC 18045, or CC:2022 and CEM:2022 | No | Criteria and methodology |
| Product category | PP, PP-Module, PP-Configuration, cPP | No | Requirements for a category |
| Product | Security Target (ST) | Yes | Requirements and claims for the TOE |
| Implementation | Target of Evaluation (TOE) | Yes | What is evaluated |
| Evaluated functions | TSF | Yes | Parts of the TOE that implement the SFRs |
EAL 1 to EAL 7, component by component
Section titled “EAL 1 to EAL 7, component by component”The seven Evaluation Assurance Levels are packages defined in CC:2022 Part 5 (ISO/IEC 15408-5). Each higher EAL substitutes a hierarchically higher component or adds a family. They measure the depth of the evaluation, not the strength of the product. The table below takes the names and the components that differ most from Table 1 of CC:2022 Part 5, the attack potential from each package description, and the EUCC level from Article 4 of Regulation (EU) 2024/482.
| EAL | CC:2022 name | ADV_FSP | ADV_TDS | ADV_IMP | ADV_SPM | ALC_DVS | AVA_VAN | Attacker the analysis resists | EUCC level |
|---|---|---|---|---|---|---|---|---|---|
| EAL 1 | Functionally tested | 1 | none | none | none | none | 1 | search for public vulnerabilities, independent testing | substantial |
| EAL 2 | Structurally tested | 2 | 1 | none | none | none | 2 | basic attack potential | substantial |
| EAL 3 | Methodically tested and checked | 3 | 2 | none | none | 1 | 2 | basic attack potential | substantial |
| EAL 4 | Methodically designed, tested and reviewed | 4 | 3 | 1 | none | 1 | 3 | Enhanced-Basic attack potential | high |
| EAL 5 | Semi-formally verified designed and tested | 5 | 4 | 1 | none | 1 | 4 | moderate attack potential | high |
| EAL 6 | Semi-formally verified design and tested | 5 | 5 | 2 | 1 | 2 | 5 | high attack potential | high |
| EAL 7 | Formally verified design and tested | 6 | 6 | 2 | 1 | 2 | 5 | high attack potential | high |
Points from the package descriptions:
- EAL 1 "can be successfully conducted without assistance from the developer of the TOE" and requires only a limited ST.
- EAL 4 is "the highest level at which it is likely to be economically feasible to retrofit to an existing product line".
- EAL 5 adds semi-formal design descriptions and a modular TSF. There is no formal model at EAL 5: the formal security policy model (ADV_SPM.1) first appears at EAL 6.
- EAL 7: practical application "is currently limited" to targets with tightly focused security functionality "amenable to extensive formal analysis".
Augmentation
Section titled “Augmentation”Part 5 allows augmentation of EAL packages only, by adding components from families not in the package or by substituting a higher component. "EAL minus a component" is not a valid claim. Part 5 notes that ALC_FLR (flaw remediation) and ALC_TDA are often used as augmentations although they appear in no EAL. Smart card and similar evaluations commonly augment with AVA_VAN.5 and ALC_DVS.2: for example, the CCC Digital Key Applet Protection Profile 2.0 certified by Germany in 2025 is listed on the portal as "EAL4+ ALC_DVS.2 ALC_FLR.2 AVA_VAN.5".
Evaluation and certification
Section titled “Evaluation and certification”A CC project involves the sponsor (usually the developer), an evaluation facility (ITSEF, called CCTL in the United States) and a certification body. Under the CCRA, each authorizing nation runs one certification body; under EUCC, conformity assessment bodies are accredited (CB under ISO/IEC 17065, ITSEF under ISO/IEC 17025), and authorised by the national cybersecurity certification authority (NCCA) for level "high".
- Scheme and laboratory. The sponsor picks a scheme and a laboratory licensed or accredited (and, for EUCC "high", authorised) for the product category.
- Security Target. Drafted by the developer; its evaluation (ASE) is part of every package.
- Evidence. EUCC Article 8 requires the applicant to provide the evidence the CC and CEM ask for at the selected level, including source code where necessary, plus a link to its supplementary cybersecurity information and a description of its vulnerability management and disclosure procedures.
- Evaluation. The laboratory applies the CEM to each SAR and writes the Evaluation Technical Report (ETR).
- Certification. The certification body reviews the ETR and issues the certificate and a certification report. Under EUCC both go to the NCCA and ENISA (Article 10(5)), and ENISA publishes all EUCC certificates and their status (Article 42).
- After certification. Under the CCRA, assurance continuity follows the supporting document CCDB-014 (version of 29 February 2024). Under EUCC, the holder must run vulnerability management (Article 33, supplemented where necessary by EN ISO/IEC 30111) and the certification body can review, suspend or withdraw the certificate (Articles 13 and 14).
CCRA: what is recognised
Section titled “CCRA: what is recognised”The current Arrangement on the Recognition of Common Criteria Certificates is dated 2 July 2014 and was ratified on 8 September 2014. Article 2 limits recognition to certificates claiming:
- a cPP, with assurance activities selected from levels up to and including EAL 4 and ALC_FLR, developed through an iTC endorsed by the Management Committee; or
- EAL 1 to EAL 2 and ALC_FLR.2.
A certificate that claims more is still issued, but Annex J of the CCRA requires its logo to read "CCRA recognition for components up to EAL 2 and ALC_FLR only". So an EAL 4+ AVA_VAN.5 certificate from one nation is recognised by the others only up to EAL 2 plus ALC_FLR, cPP or not.
Members on 7 October 2026
Section titled “Members on 7 October 2026”The CCRA member page lists 18 certificate authorizing members and 18 certificate consuming members.
| Authorizing member | Scheme or body (as listed) |
|---|---|
| Australia | Australian Information Security Evaluation Program (AISEP), Australian Cyber Security Centre |
| Canada | Canadian Common Criteria Scheme, Canadian Centre for Cyber Security (CSE) |
| France | ANSSI, Centre de Certification |
| Germany | BSI certification body |
| India | Indian Common Criteria Certification Scheme (IC3S), STQC Directorate |
| Italy | OCSI, National Cybersecurity Agency (ACN) |
| Japan | JISEC, Information-technology Promotion Agency (IPA) |
| Malaysia | MyCC Scheme, CyberSecurity Malaysia |
| Netherlands | Dutch Authority for Digital Infrastructure |
| Norway | SERTIT |
| Poland | NASK National Research Institute |
| Qatar | Qatar Common Criteria Scheme, National Cyber Security Agency |
| Republic of Korea | IT Security Certification Center (ITSCC), National Security Research Institute |
| Singapore | Cyber Security Agency of Singapore |
| Spain | CCN certification body |
| Sweden | CSEC, FMV |
| Turkey | TSE Common Criteria Certification Scheme |
| United States | National Information Assurance Partnership (NIAP) |
Consuming members: Austria, Bangladesh, Belgium, Cyprus, Czech Republic, Denmark, Ethiopia, Finland, Greece, Hungary, Indonesia, Israel, Jordan, New Zealand, Pakistan, Slovakia, Ukraine and the United Kingdom, whose NCSC scheme is listed as consuming. NIAP is the United States scheme operated by the NSA, according to an NSA press release.
CCRA and EUCC co-existence
Section titled “CCRA and EUCC co-existence”The CCRA Management Committee approved CCMC-011 on 17 February 2025 (issued 19 March 2025). It notes that EUCC "allows for certifications by commercial bodies without equivalent government oversight as in the CCRA", and sets a per-certificate oversight process, run by the CCRA participant (usually the same organisation as the NCCA), through which an EUCC certificate can also carry the CCRA mark. Without that mark, an EUCC certificate is not a CCRA certificate.
SOG-IS: closed to new certificates
Section titled “SOG-IS: closed to new certificates”The SOG-IS Mutual Recognition Agreement (MRA, version 3.0, January 2010) recognised certificates at EAL 1 to EAL 4 in general, and higher assurance levels, including augmentations, only for IT technical domains agreed by its Management Committee. Two domains existed: Smartcards and Similar Devices (chip-level hardware security, such as smart card ICs, composite products, TPMs and tachograph cards) and Hardware Devices with Security Boxes (such as payment terminals, tachograph vehicle units, smart meters and hardware security modules). Its participants were government bodies from EU or EFTA countries.
The SOG-IS home page now states: "As of 27th February 2026 SOG-IS cease to emit certificates, this website is no longer updated." That date is the end of the window in Article 49(2) of the EUCC Regulation. The EUCC Regulation reuses both technical domains in Annex I, with their supporting documents turned into EUCC state-of-the-art documents. In June 2023 SOG-IS had accepted CC:2022 and CEM:2022, in both the CCRA and ISO versions.
| Characteristic | CCRA (2014) | SOG-IS MRA (v3.0, 2010) | EUCC (Reg. 2024/482) |
|---|---|---|---|
| Nature | Arrangement between nations | Agreement between EU and EFTA government bodies | EU implementing regulation |
| Recognised scope | EAL 1 to 2 and ALC_FLR.2, or cPP (up to EAL 4 and ALC_FLR) | EAL 1 to 4; higher levels in agreed technical domains | Two levels: substantial (AVA_VAN.1 to 2), high (AVA_VAN.3 to 5) |
| Who certifies | One certification body per authorizing nation | National schemes | Accredited CBs; NCCA authorisation for "high" |
| Status on 7 October 2026 | Active, CC:2022 R1 | No new certificates since 27 February 2026 | Applies since 27 February 2025, amended twice |
EUCC rules that matter for a product team
Section titled “EUCC rules that matter for a product team”Regulation (EU) 2024/482 was adopted on 31 January 2024 under the Cybersecurity Act (EU) 2019/881. It uses the Common Criteria and the CEM as set out in ISO/IEC 15408 and ISO/IEC 18045 (Articles 2 and 3), without dating the editions.
| Article | Rule |
|---|---|
| 4 | Certificates at "substantial" (AVA_VAN.1 or 2) or "high" (AVA_VAN.3, 4 or 5) |
| 5 | Certification against the ST as defined by the applicant, or incorporating a certified PP |
| 6 | No conformity self-assessment |
| 7(3) | AVA_VAN.4 or 5 only within an Annex I technical domain (smart cards and similar devices; hardware devices with security boxes), under a PP listed in Annex II (EN 419241-2:2019 and EN 419221-5:2018 for remote qualified signature and seal creation devices in the original text), or by an exception approved by the NCCA |
| 11 | Mark and label on the product with assurance level, AVA_VAN level, certificate identifier and a QR code to a website with validity information |
| 12 | Certificate validity set by the certification body, no more than 5 years without NCCA approval |
| 17(4) | Protection Profiles certified only by an NCCA or another public body, or by a CB with NCCA approval for each PP |
| 21 | CB authorisation for "high" by the NCCA, including a pilot certification |
| 33 | Vulnerability management by the certificate holder |
| 42 | ENISA publishes all certificates, their status and certification reports |
| 49 | National schemes covered by EUCC cease 12 months after entry into force; started processes finish within 24 months; Cybersecurity Act Article 57(3) keeps existing national certificates valid until expiry |
Two amendments followed. Regulation (EU) 2024/3144 of 18 December 2024 added a state-of-the-art document on accreditation of certification bodies and amended the one for evaluation facilities. Regulation (EU) 2025/2462 of 8 December 2025 covers definitions, ICT product series certification, assurance continuity and updated state-of-the-art documents; ENISA lists which versions apply.
EUCC and the Cyber Resilience Act
Section titled “EUCC and the Cyber Resilience Act”The CRA, Regulation (EU) 2024/2847, is in force; Chapter IV on notified bodies applies from 11 June 2026, the reporting obligations of Article 14 from 11 September 2026 and the rest from 11 December 2027. Three provisions concern EUCC:
- Article 27(8): products certified under a European cybersecurity certification scheme are presumed to conform to the Annex I essential requirements "in so far as" the certificate covers them (presumption of conformity).
- Article 27(9): the Commission may specify by delegated act which schemes can be used; a certificate at least "substantial" then removes the third-party assessment for the requirements it covers.
- Article 8(1): the Commission may require a European certificate at least "substantial" for the Annex IV critical products: hardware devices with security boxes, smart meter gateways and devices for advanced security purposes, and smartcards or similar devices including secure elements.
See the Cyber Resilience Act guide for the conformity routes.
France: ANSSI and CSPN
Section titled “France: ANSSI and CSPN”ANSSI is a CCRA certificate authorizing member and publishes the certificates issued under both its Common Criteria scheme and the CSPN, a French national scheme that does not follow ISO/IEC 15408 and is outside the CCRA. See the CSPN ANSSI guide for the comparison.
Claims the texts contradict
Section titled “Claims the texts contradict”| Common claim (including earlier versions of this page) | What the texts say |
|---|---|
| ISO/IEC 15408:2022 is the current edition | ISO/IEC 15408-1 to -4:2026 and 18045:2026 were published on 19 May 2026, part 5 on 28 April 2026; the IEC catalogue marks 15408-1:2022 withdrawn on 19 May 2026. The CCRA portal still publishes CC:2022 R1 |
| CC went through versions 2.x, 3.x and 4.x before 2022 | There is no CC 4.x. CC v3.1 Release 5 is the last v3.1 revision, followed directly by CC:2022 |
| Above EAL 2 plus ALC_FLR, a cPP guarantees CCRA recognition at the certificate level | A cPP is limited to assurance activities up to and including EAL 4 and ALC_FLR (Article 2), normally EAL 2 (Annex K). Higher certificates carry "CCRA recognition for components up to EAL 2 and ALC_FLR only" |
| EAL 3 includes covert channel analysis; EAL 5 includes partial formal modelling | CC:2022 Part 5 has no covert channel family in any EAL. The formal security policy model ADV_SPM.1 starts at EAL 6 |
| The United Kingdom NCSC is a certificate authorizing member | The CCRA member page lists the United Kingdom as a consuming member |
| The Dutch scheme is TÜV Rheinland Nederland; the Korean scheme is KCMVP under NIS | The member page lists the Dutch Authority for Digital Infrastructure, and the IT Security Certification Center of the National Security Research Institute for Korea. |
| The NCCA issues EUCC certificates on behalf of the Union | Accredited certification bodies issue EUCC certificates (Article 9); the NCCA authorises them for "high" (Article 21) and ENISA publishes the certificates (Article 42) |
| The "future" CRA recognises EUCC certificates as presumption of conformity | The CRA has been in force since 2024. Article 27(8) gives a presumption only for the requirements a certificate covers, and Article 27(9) leaves it to delegated acts to specify which schemes count |
| SOG-IS recognised every certificate up to EAL 7 | The SOG-IS MRA v3.0 recognises EAL 1 to EAL 4; higher levels only in agreed technical domains |
| EUCC replaces national schemes "progressively" | Article 49 set fixed dates: national schemes covered by EUCC ceased on 27 February 2025, with started processes to be finished by 27 February 2026 |
Practical points
Section titled “Practical points”| Point | What to check |
|---|---|
| Which edition to cite | For a CCRA certificate, the version the scheme applies (CC:2022 R1 and errata v1.2 on the portal); for EUCC, the ISO/IEC 15408 and 18045 references in the Regulation and state-of-the-art documents |
| Target market | Outside the EU, CCRA recognition depends on the scope in Article 2. Inside the EU, a new CC certificate is an EUCC certificate |
| AVA_VAN.4 or 5 under EUCC | Only within a technical domain, a state-of-the-art PP, or an approved exception (Article 7(3)) |
| A cPP for the category | Check the portal list of iTCs and cPPs at project start |
| TOE boundary | The certificate or certification report states whether the whole product or only parts were certified |
| Life cycle evidence | ALC families grow with the EAL (ALC_DVS.2 from EAL 6, ALC_TAT from EAL 4); smart card augmentations often add ALC_DVS.2 |
| Old v3.1 PPs | Usable in a CC:2022 ST until 31 December 2027 |
Community
Section titled “Community”The International Common Criteria Conference (ICCC) is listed on the portal as the meeting of certification bodies, laboratories and developers. The 2026 edition was held in Rome from 28 September to 1 October 2026. See the spilma glossary for definitions of CC terms.
See also
Section titled “See also”- Product cybersecurity: obligation, evaluation, label
- DO-326A and ED-202A: avionics cybersecurity airworthiness
- PSA Certified: Arm-led IoT security baseline
- SESIP: IoT platform security evaluation methodology
- TPM 2.0 and TCG hardware security
- FIPS 140-3: cryptographic module validation
- CSPN and ANSSI Visa: French cybersec certification
- CMMC and UK Cyber Essentials: defense cyber baselines
- EMVCo and PCI PTS: payment device certification
Synthesis
Section titled “Synthesis”Common Criteria now exists as ISO/IEC 15408:2026 and ISO/IEC 18045:2026 on the ISO side and as CC:2022 Release 1 on the CCRA side. The EAL packages grade evaluation depth through components such as AVA_VAN, which EUCC uses to define its "substantial" and "high" levels. CCRA recognition between nations stops at EAL 2 plus ALC_FLR or a cPP. In the EU, SOG-IS has stopped issuing certificates and EUCC is the scheme, with the CRA able to build on it for critical products.
Sources & references
- Common Criteria Portal, Publications: CC:2022 Release 1, CEM:2022, errata, supporting documents, Common Criteria Recognition Arrangement www.commoncriteriaportal.org/cc/index.cfm
- CCMC-2023-04-001, Transition Policy to CC:2022 and CEM:2022 (20 April 2023), CCRA Management Committee www.commoncriteriaportal.org/files/ccfiles/CC2022CEM2022TransitionPolicy.pdf
- CC:2022 Part 5, Pre-defined packages of security requirements (EAL tables), November 2022, Common Criteria Recognition Arrangement www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf
- Arrangement on the Recognition of Common Criteria Certificates (CCRA), 2 July 2014, ratified 8 September 2014, Common Criteria Recognition Arrangement www.commoncriteriaportal.org/files/CCRA%20-%20July%202,%202014%20-%20Ratified%20September%208%202014.pdf
- Members of the CCRA (authorizing and consuming), Common Criteria Recognition Arrangement www.commoncriteriaportal.org/ccra/members/index.cfm
- CCMC-011 v1.0, CCRA and EUCC Co-existence (19 March 2025), CCRA Management Committee www.commoncriteriaportal.org/files/supdocs/CCMC-011-v1.0-2025-Mar-19-CCRA%20and%20EUCC%20Co-existence.pdf
- International Technical Communities and collaborative Protection Profiles, Common Criteria Recognition Arrangement www.commoncriteriaportal.org/communities/index.cfm
- ISO/IEC 15408-1:2026, Part 1: Introduction and general model (edition 5.0, 19 May 2026), IEC Webstore (ISO/IEC JTC 1/SC 27) webstore.iec.ch/en/publication/113680
- ISO/IEC 15408-1:2022 (edition 4.0, 9 August 2022, withdrawn 19 May 2026), IEC Webstore (ISO/IEC JTC 1/SC 27) webstore.iec.ch/en/publication/78355
- ISO/IEC 15408-5:2026, Part 5: Pre-defined packages of security requirements (edition 2.0, 28 April 2026), IEC Webstore (ISO/IEC JTC 1/SC 27) webstore.iec.ch/en/publication/113445
- ISO/IEC 18045:2026, Requirements and methodology for IT security evaluation (edition 4.0, 19 May 2026), IEC Webstore (ISO/IEC JTC 1/SC 27) webstore.iec.ch/en/publication/113678
- Implementing Regulation (EU) 2024/482 establishing the EUCC scheme, EUR-Lex eur-lex.europa.eu/eli/reg_impl/2024/482/oj
- Implementing Regulation (EU) 2024/3144 amending the EUCC (accreditation state-of-the-art documents), EUR-Lex eur-lex.europa.eu/eli/reg_impl/2024/3144/oj
- Implementing Regulation (EU) 2025/2462 amending the EUCC (product series, assurance continuity, state-of-the-art documents), EUR-Lex eur-lex.europa.eu/eli/reg_impl/2025/2462/oj
- Regulation (EU) 2019/881 Cybersecurity Act, legal basis of the EUCC scheme, EUR-Lex eur-lex.europa.eu/eli/reg/2019/881/oj
- Regulation (EU) 2024/2847 Cyber Resilience Act, Articles 8 and 27 and Annex IV, EUR-Lex eur-lex.europa.eu/eli/reg/2024/2847/oj
- EUCC Certification Scheme page, implementing act, amendments and state-of-the-art documents, ENISA certification.enisa.europa.eu/certification-library/eucc-certification-scheme_en
- SOG-IS Mutual Recognition Agreement, official portal and technical domains, Senior Officials Group Information Systems Security www.sogis.eu/
- SOG-IS Mutual Recognition Agreement version 3.0 (January 2010), Senior Officials Group Information Systems Security www.sogis.eu/documents/mra/20100107-sogis-v3.pdf
- National Information Assurance Partnership celebrates 25 years, National Security Agency www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3449329/national-information-assurance-partnership-celebrates-25-years/
- ANSSI, certified and qualified solutions (CSPN and Common Criteria certificates), ANSSI cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/
Frequently asked questions
- What are Common Criteria and what is ISO/IEC 15408 for?
- Common Criteria (CC) is the framework for evaluating the security of IT products. ISO/IEC 15408 holds the criteria (security functional and assurance components, evaluation assurance levels) and ISO/IEC 18045 holds the evaluation methodology (CEM). The CCRA nations publish the same content as CC:2022 Release 1 and CEM:2022. A licensed laboratory evaluates the product and a certification body issues the certificate.
- Which edition is current, 2022 or 2026?
- ISO and IEC published ISO/IEC 15408-1 to -4:2026 and ISO/IEC 18045:2026 on 19 May 2026 and ISO/IEC 15408-5:2026 on 28 April 2026; the 2022 editions are withdrawn. The Common Criteria Portal, checked on 7 October 2026, still publishes CC:2022 Release 1 with errata v1.2 as the CCRA version. CC v3.1 Release 5 could only be used for evaluations started by 30 June 2024.
- What is the difference between a Protection Profile and a Security Target?
- A Protection Profile (PP) states implementation-independent security requirements for a category of products. A Security Target (ST) states the requirements for one specific product (the TOE). An ST can claim conformance to PPs; CC:2022 defines three conformance types: exact, strict and demonstrable. A collaborative PP (cPP) is a PP developed by an International Technical Community endorsed by the CCRA.
- Up to what level are certificates mutually recognised under the CCRA?
- Article 2 of the 2014 CCRA covers certificates claiming EAL 1 to 2 plus ALC_FLR, or a cPP whose assurance activities are selected from levels up to and including EAL 4 plus ALC_FLR. A certificate claiming more (EAL 4 augmented with AVA_VAN.5, for instance) stays valid, but the CCRA logo then carries the wording "CCRA recognition for components up to EAL 2 and ALC_FLR only".
- What are EAL levels and how do they map to EUCC?
- EAL 1 to EAL 7 are the pre-defined assurance packages of ISO/IEC 15408-5. They grade evaluation depth, not product strength. The EUCC Regulation keys its two levels on the vulnerability analysis component: AVA_VAN.1 or 2 is "substantial" (EAL 1 to EAL 3 as packaged) and AVA_VAN.3, 4 or 5 is "high" (EAL 4 to EAL 7). AVA_VAN.4 and 5 under EUCC need a technical domain, a state-of-the-art PP, or an NCCA-approved exception.
- What happened to SOG-IS?
- The EUCC scheme applies from 27 February 2025. Article 49 of Regulation (EU) 2024/482 ended national CC schemes covered by EUCC 12 months after its entry into force, with processes already started allowed to finish by 27 February 2026. The SOG-IS website states that SOG-IS ceased to emit certificates as of 27 February 2026. Existing national certificates stay valid until their expiry date (Cybersecurity Act, Article 57(3)).
- Is Common Criteria mandatory for CE marking or the CRA?
- Not today as a general rule. EUCC certification is voluntary and Article 6 of the EUCC Regulation forbids self-assessment. Under the CRA, Article 27(8) gives a presumption of conformity for the parts of Annex I a European certificate covers, Article 27(9) lets the Commission specify by delegated act which schemes count, and Article 8(1) lets it require a certificate at least "substantial" for the Annex IV critical products (security boxes, smart meter gateways, smart cards and secure elements).
- What is the difference between CSPN and Common Criteria at ANSSI?
- CSPN is a French national evaluation scheme run by ANSSI that does not follow ISO/IEC 15408 and sits outside the CCRA. Common Criteria evaluations follow ISO/IEC 15408 and ISO/IEC 18045 and can carry international recognition. ANSSI publishes both lists of certificates. See the dedicated CSPN guide.