Common Criteria | Certification
Common Criteria (CC) is the internationally recognized cybersecurity certification framework for IT, IoT and OT products.
> IoT | Testing and Certification > Common Criteria | Certification
COMMON CRITERIA | CERTIFICATION
Common Criteria (CC) is the internationally recognized framework for evaluating and certifying the security of IT, IoT and operational technology (OT) products. Based on the ISO/IEC 15408 standard, Common Criteria provides an independent and structured methodology to assess whether a product's security functionality meets defined requirements and can withstand relevant cybersecurity threats.
Common Criteria certification helps manufacturers, software vendors and technology providers demonstrate the security assurance of their products to customers, regulators and procurement authorities worldwide. Certified products benefit from international recognition through the Common Criteria Recognition Arrangement (CCRA), enabling market access across Europe, North America, Asia-Pacific and other participating countries.
The framework can be applied to a broad range of products, including software applications, operating systems, network devices, embedded systems, industrial control systems and connected IoT products. Depending on the security objectives and target market, evaluations can be performed at different Evaluation Assurance Levels (EALs).
Zhenyu Zhu
EUCC Certification Lead
Hikvision
Our partnership with Bureau Veritas delivered the world’s first EUCC certification for cameras, validating our security leadership globally.
WHY CERTIFY UNDER COMMON CRITERIA?
Common Criteria certification provides independent assurance that a product's security functionality has been evaluated against internationally recognized requirements. For technology vendors, manufacturers and software developers, certification demonstrates a commitment to cybersecurity and helps build trust with customers, regulators and procurement authorities.
International recognition
Common Criteria certificates are recognized by countries participating in the Common Criteria Recognition Arrangement (CCRA), enabling manufacturers to demonstrate product security across multiple markets through a widely accepted certification framework. Through the CCRA, certified products can benefit from international recognition in Europe, North America, Asia-Pacific and other participating regions, helping organizations reduce the need for multiple national certifications and facilitating access to global markets.
Support government and enterprise procurement
Many public sector organizations, critical infrastructure operators and large enterprises require or strongly prefer independently evaluated products. Common Criteria certification can help meet procurement requirements and simplify security assessments during vendor selection processes.
Differentiate your product in the market
Certification provides an objective demonstration of security assurance, helping organizations distinguish their products in competitive markets. A Common Criteria certificate can strengthen customer confidence and support market adoption in sectors where cybersecurity is a key purchasing criterion.
Support regulatory and compliance objectives
Common Criteria evaluations require a structured approach to security design, testing and documentation. The resulting evidence can support broader cybersecurity and compliance initiatives, including alignment with emerging regulations and certification schemes such as the European Union Cybersecurity Certification Scheme (EUCC).
Improve product security
The evaluation process includes an independent assessment of the product's security functionality, architecture, development practices and testing activities. This helps identify weaknesses early and contributes to the overall security maturity of the product.
Need Common Criteria certification for market access?
We help vendors navigate the entire certification process, from preparation and gap analysis to evaluation support and certification.
SCOPE OF COMMON CRITERIA CERTIFICATION
Common Criteria can be applied to a wide range of products that provide security functionality and require independent assurance. The framework is designed to evaluate whether a product's security mechanisms are correctly implemented and effective against relevant threats.
Products commonly evaluated under Common Criteria include:
- IoT and embedded devices
- Industrial control systems (ICS) and SCADA solutions
- Medical devices
- Automotive components and connected systems
- Smart meters and critical infrastructure products
- Software applications
- Operating systems
- Mobile and web applications
- Network and telecommunications equipment
- Smart cards, secure elements and integrated circuits
- Security appliances and enterprise solutions
Expertise in connected products and software
Bureau Veritas Cybersecurity specializes in the evaluation of connected products and software solutions, supporting organizations throughout the certification process. Our expertise includes:
- IoT and embedded systems
- Network and telecommunications products
- Enterprise software and applications
- Operating systems and platform software
- Connected devices for consumer and industrial environments
Our evaluation services help manufacturers prepare for Common Criteria certification while supporting broader cybersecurity objectives and regulatory requirements. For organizations targeting the European market, Common Criteria evaluations can also provide a strong foundation for certification under the European Union Cybersecurity Certification Scheme (EUCC) and alignment with emerging cybersecurity regulations such as the Cyber Resilience Act (CRA).
For use of reusable components
For IoT devices and platforms built using reusable hardware and software components, SESIP certification may offer a more efficient certification approach. Unlike traditional Common Criteria evaluations, SESIP allows manufacturers to reuse existing security evaluation results, helping reduce duplicate assessment effort and accelerate time-to-market. Learn more about our SESIP Certification services.
For smartphones, tablets, wearables
For smartphones, tablets, wearables and other connected consumer devices, manufacturers may also consider GSMA MDSCert certification. MDSCert provides a standardized security baseline specifically designed for connected consumer devices and is recognized across the mobile ecosystem. Learn more about our GSMA MDSCert certification services.
Free Guide for Product Manufacturers
What does the shift from Common Criteria to EUCC mean for manufacturers targeting the European market? Download the free guide to discover.
EVALUATION ASSURANCE LEVELS (EAL)
Common Criteria evaluations can be performed at different Evaluation Assurance Levels (EALs), which indicate the depth and rigor of the assessment. The selected assurance level depends on the product type, intended use, security objectives and market requirements.
The Common Criteria framework defines seven Evaluation Assurance Levels, ranging from EAL1 to EAL7:
- EAL1 – Functionally Tested
Basic assurance based on functional testing and review of available documentation. - EAL2 – Structurally Tested
Increased assurance through structured testing and examination of development evidence. - EAL3 – Methodically Tested and Checked
A more comprehensive evaluation of the product's design, development and testing activities. - EAL4 – Methodically Designed, Tested and Reviewed
One of the most commonly requested assurance levels for commercial products. EAL4 provides a high level of confidence while remaining achievable for many software, network and embedded products. - EAL5 – Semiformally Designed and Tested
Suitable for products protecting sensitive information or operating in higher-risk environments. - EAL6 – Semiformally Verified Design and Tested
Intended for products requiring a very high level of assurance against sophisticated threats. - EAL7 – Formally Verified Design and Tested
The highest assurance level defined by Common Criteria, typically reserved for products protecting highly sensitive or critical assets.
In practice, many commercial products are evaluated at assurance levels ranging from EAL1 to EAL4, while security-critical products such as smart cards, secure elements and specialized security devices may require higher assurance levels.
In addition to the assurance level, evaluations may include augmentation components, such as vulnerability analysis requirements, resulting in designations such as EAL4+. These augmented evaluations provide additional assurance for products operating in demanding security environments.
PROTECTION PROFILES AND SECURITY TARGETS
Common Criteria evaluations are based on clearly defined security requirements and evaluation objectives. Two key concepts within the framework are the Protection Profile (PP) and the Security Target (ST).
Protection Profiles (PP)
A Protection Profile defines a set of standardized security requirements for a specific category of products. It describes the security problem to be addressed, the expected security objectives and the functional and assurance requirements that products within that category should satisfy.
Protection Profiles help establish a common baseline for security evaluations and enable purchasers, regulators and certification schemes to compare products against consistent requirements.
Security Targets (ST)
A Security Target is a product-specific document that defines the security functionality, security objectives and evaluation scope for the product being certified.
The Security Target serves as the foundation of the evaluation and describes:
- The product and its intended use
- Security assumptions and threat models
- Security objectives
- Security functional requirements
- Security assurance requirements
During the evaluation process, the product is assessed against the claims made in its Security Target to determine whether the defined security requirements have been met.
Supporting a successful evaluation
Preparing high-quality Common Criteria documentation is a critical step in achieving certification. Bureau Veritas Cybersecurity supports organizations in defining evaluation scopes, preparing Security Targets and navigating the certification process efficiently, helping reduce delays and streamline communication with certification authorities.
COMMON CRITERIA AND EUCC: WHAT'S THE DIFFERENCE?
Common Criteria (CC) and the European Union Cybersecurity Certification Scheme (EUCC) are closely related, but they serve different purposes.
Common Criteria (ISO/IEC 15408) is the internationally recognized framework used to evaluate the security of IT and ICT products. It defines the methodology, assurance requirements, Protection Profiles, Security Targets and evaluation activities used by accredited laboratories and certification bodies worldwide.
EUCC is the European cybersecurity certification scheme established under the EU Cybersecurity Act. The scheme builds on Common Criteria principles and methodologies while providing a harmonized certification framework for the European Union.
For manufacturers and technology providers, both schemes offer a structured approach to demonstrating product security. The most suitable certification path depends on factors such as target markets, customer requirements, regulatory obligations and procurement expectations.
As an accredited evaluation laboratory, Bureau Veritas Cybersecurity supports organizations with both Common Criteria and EUCC evaluations, helping determine the most appropriate certification strategy for their products and business objectives.
For manufacturers of IoT devices, secure elements, chipsets and connected platforms, SESIP provides another internationally recognized certification approach. While Common Criteria focuses on comprehensive product evaluations, SESIP uses a compositional methodology that enables organizations to reuse existing evaluation results across components and product families.
For manufacturers of smartphones, tablets, wearables and other connected consumer devices, GSMA MDSCert provides another internationally recognized certification option. Unlike Common Criteria, which applies to a broad range of IT, IoT and OT products, MDSCert is specifically designed to evaluate the security of connected consumer devices against GSMA requirements.
Looking for EU-wide cybersecurity certification? Learn more about our EUCC certification services.
Bureau Veritas Cybersecurity is a licensed laboratory for CC and EUCC services
Bureau Veritas Cybersecurity is your partner for CC and EUCC certification of network, IoT and software products.
HOW WE SUPPORT YOU
Bureau Veritas Cybersecurity provides Common Criteria evaluation services for manufacturers, software vendors and technology providers across Europe. Our experts support organizations throughout the certification process, from initial preparation and documentation to evaluation activities and certification support.
Our services include:
- Certification readiness assessments
- Evaluation scope definition
- Security Target preparation and review
- Functional and assurance testing
- Vulnerability assessment activities
- Coordination with certification authorities
- Support for Common Criteria and EUCC certification projects
We perform Common Criteria evaluations under the Dutch certification framework in collaboration with TrustCB and the Dutch National Cybersecurity Certification Authority (NCCA), helping organizations navigate the certification process efficiently and with confidence.
With extensive experience in connected products, software, network technologies and embedded systems, Bureau Veritas Cybersecurity helps organizations achieve certification efficiently while supporting broader cybersecurity and compliance objectives.
Bureau Veritas Cybersecurity is part of the Bureau Veritas Group, a global leader in testing, inspection and certification services.
Downloads
FREQUENTLY ASKED QUESTIONS ABOUT COMMON CRITERIA CERTIFICATION
What is Common Criteria certification?
Common Criteria certification is an internationally recognized cybersecurity certification that evaluates the security functionality and assurance of IT, IoT, and OT products. Based on the ISO/IEC 15408 standard, the Common Criteria framework provides an independent assessment of whether a product meets defined security requirements and can withstand relevant cybersecurity threats.
What are Evaluation Assurance Levels (EALs)?
Evaluation Assurance Levels (EALs) indicate the depth and rigor of a Common Criteria evaluation. The Common Criteria framework defines seven assurance levels, ranging from EAL1 to EAL7, with each level requiring progressively more extensive evaluation activities. The appropriate EAL depends on factors such as the product type, security objectives, intended use, and market requirements. Many commercial software, network, and IoT products are evaluated at EAL1 through EAL4, while higher assurance levels are typically reserved for security-critical products.
What is the difference between Common Criteria and EUCC?
Common Criteria (CC) is the internationally recognized framework used to evaluate the security of IT and ICT products. It defines the methodology, assurance requirements, and evaluation processes used by accredited laboratories worldwide.
EUCC (European Union Cybersecurity Certification Scheme) is the European cybersecurity certification scheme established under the EU Cybersecurity Act. EUCC builds on Common Criteria principles and methodologies while providing a harmonized certification framework for the European Union.
Organizations seeking certification should evaluate which scheme best aligns with their target markets, customer requirements, and regulatory obligations. Bureau Veritas Cybersecurity supports both Common Criteria and EUCC certification projects.
How long does Common Criteria certification take?
The duration of a Common Criteria certification project depends on several factors, including the complexity of the product, the target Evaluation Assurance Level (EAL), the maturity of the product documentation, and the scope of the evaluation.
Well-prepared projects may be completed within a few months, while more complex evaluations can take significantly longer. Early preparation of key documentation, such as the Security Target, and close collaboration with the evaluation laboratory can help streamline the certification process and reduce delays.
Bureau Veritas Cybersecurity can help organizations assess their readiness for certification, define the scope of the evaluation, and develop a realistic certification roadmap.
Should I choose Common Criteria or SESIP?
The right certification depends on your product, target market and business objectives. Common Criteria is widely used for products requiring internationally recognized security assurance across many technology domains. SESIP is specifically designed for IoT platforms and connected devices and enables manufacturers to reuse existing security evaluation results, reducing certification effort and accelerating development. Bureau Veritas can help determine which certification path best fits your product.
Should I choose Common Criteria or MDSCert?
The right certification depends on your product and target market. Common Criteria is an internationally recognized security evaluation framework for a broad range of IT, IoT and OT products.
MDSCert is specifically designed for smartphones, tablets, wearables and connected consumer devices, providing a standardized security baseline aligned with GSMA requirements. Bureau Veritas can help determine which certification scheme best fits your product and business objectives.
NEED GUIDANCE ON COMMON CRITERIA OR EUCC?
Whether you are exploring certification requirements or preparing for an evaluation, our experts can help you define the most suitable certification strategy for your product. Please fill out the form below, and we will contact you within one business day.
Why choose Bureau Veritas Cybersecurity
Bureau Veritas Cybersecurity is your expert partner in cybersecurity. We help organizations identify risks, strengthen defenses and comply with cybersecurity standards and regulations. Our services cover people, processes and technology, ranging from awareness training and social engineering to security advice, compliance and penetration testing.
We operate across IT, OT and IoT environments, supporting both digital systems and connected products. With over 300 cybersecurity professionals worldwide, we combine deep technical expertise with a global presence. Bureau Veritas Cybersecurity is part of the Bureau Veritas Group, a global leader in testing, inspection and certification.