Common Criteria

Definition

Common Criteria is an international standard, formally ISO/IEC 15408, for evaluating the security properties of information technology products against a defined set of requirements and assurance levels. Vendors submit products to accredited testing laboratories, which evaluate them against a chosen Protection Profile or custom Security Target and assign an Evaluation Assurance Level, and results are recognized across countries participating in the Common Criteria Recognition Arrangement, allowing one certification to be accepted in multiple markets.

Overview

Common Criteria emerged from an effort to unify several earlier, incompatible national security evaluation schemes, including U.S., European, and Canadian standards, that each required vendors to undergo separate certification processes to sell secure products into different government markets. Governments and vendors both wanted a single internationally recognized way to state "this product has been independently evaluated to meet this security specification," rather than repeating redundant national evaluations for every jurisdiction. Mechanically, a vendor submits a product for evaluation against a Security Target, a document defining the specific security functionality claimed and the environment assumptions, often based on a published Protection Profile that defines baseline requirements for a product category such as firewalls or operating systems. An accredited, independent testing laboratory evaluates the product's design documentation, development process, and test evidence against the claims, assigning an Evaluation Assurance Level ranging from lower levels representing basic functional testing to higher levels requiring formal design verification and more rigorous development process scrutiny. Certification bodies in participating countries oversee their national evaluation labs and issue the final certificate. Common Criteria differs from FIPS 140-2 in scope: FIPS 140-2 evaluates cryptographic modules specifically against a fixed set of security requirements, while Common Criteria evaluates a much broader range of product types against flexible, product-category-specific Protection Profiles, and a product can require both, for example an evaluated firewall that also embeds a FIPS-validated cryptographic module. It differs from management-system standards like ISO 27001 by evaluating a specific product rather than an organization's overall security program. In practice, Common Criteria certification is most relevant to vendors selling security-relevant IT products, such as operating systems, network devices, smart cards, and hardware security modules, into government and defense procurement processes that require it as a purchasing condition. Because certification under the Common Criteria Recognition Arrangement is recognized across member countries, a vendor evaluated once in one jurisdiction can often satisfy procurement requirements elsewhere without a full re-evaluation, though higher assurance levels have historically had more limited mutual recognition. The process is lengthy and expensive, often taking many months to years depending on the assurance level sought, and evaluated products can require re-certification or impact analysis when updated, creating tension with fast-moving software development practices. Because of this cost, Common Criteria is generally pursued only when a specific government procurement requirement demands it, and vendors without such customers typically rely on other security assurances, such as internal secure development practices or narrower certifications like FIPS 140-2, rather than pursuing full product evaluation.

Key Concepts

• Formally standardized internationally as ISO/IEC 15408
• Evaluates products against a Security Target or published Protection Profile
• Assigns Evaluation Assurance Levels reflecting depth of security testing
• Conducted by accredited, independent testing laboratories
• Recognized across countries under the Common Criteria Recognition Arrangement
• Applies to specific IT products rather than whole organizations
• Commonly required for government and defense procurement of secure products
• Distinct from but sometimes paired with FIPS 140-2 cryptographic validation

Use Cases

Frequently Asked Questions

Related in Cybersecurity