About Common Criteria
Common Criteria is internationally recognized as an ISO standard 15408 and through the Common Criteria Recognition Agreement (CCRA) certified products for EAL 1-4 are recognized internationally as well. Testing and certifying products using Common Criteria is an important tool for ensuring that not only do we have truly global standards for certifying commercial software products, but that these bring real benefits for both commercial suppliers and end users in both government and public sector. Commercial suppliers only need certification once to make their products acceptable to any member country. Evaluated products benefit by identifying and correcting vulnerabilities, thus obtaining improved security as an end result.
The Common Criteria is internationally recognized. In June 1993, the sponsoring organizations of the existing US, Canadian, and European criterias started the CC Project to align their separate criteria into a single set of IT security criteria. Version 1.0 of the CC was completed in January 1996. Based on a number of trial evaluations and an extensive public review, Version 1.0 was extensively revised and CC Version 2.0 was produced in April of 1998. This became ISO International Standard 15408 in 1999. The CC Project subsequently incorporated the minor changes that had resulted in the ISO process, producing CC version 2.1 in August 1999. It provides a single, comprehensible world-wide set of measures against which products can be judged. In an increasingly global market, developers and buyers alike can compare like with like security functionality claims.
The US Department of Defense requires that all products purchased by their department by Common Criteria validated. Common Criteria is also an ISO standard 15408, ACSI 33, and is followed by the EU and IEEE.
CC services include:
- Selection or development of a Protection Profile
- Development of a Security Target
- Performing IT product evaluations for EAL 1-4
- Development of CC evaluation evidence