Cyber security common criteria evaluation and certification

Compliance with the Common Criteria detailed in ISO/IEC 15408-1 consists of two quality assurance aspects:

• Assessment of Security Assurance Requirements (SARs) — This is a review of the processes undertaken during the development and evaluation of a given IT product to assess compliance with the prescribed security functionality, which may vary depending on their intended use and anticipated risk environment.
• Evaluation Assurance Level (EAL) — This assesses the difficulty of the evaluation process itself, and can range from the most basic level of cyber security (EAL 1) through the most rigorous process to verify the claimed level of security (EAL 7).

*It is important to note that an EAL is only an assessment of the rigour of the evaluation process itself: ITE with a higher EAL does not necessarily indicate a more secure device.

How Nemko Can Help

Nemko can provide comprehensive guidance according to the Common Criteria requirements detailed in ISO/IEC 15408-1.

• Protection Profile Assessment— Procurement organizations may require third-party vendors to offer evidence that their product has been designed to conform to the requirements of one or more protection profiles (PP). Nemko experts can work with you to assess your equipment's compliance with relevant PPs and provide attestation to support your claims.
• EAL/Security Target (ST) Assessment—The PP assessment can serve as a basis for defining the required security properties, so Nemko experts can conduct an evaluation of your equipment consistent with both the required STs and the requisite EAL.
• Nemko can also conduct a preliminary functional gap assessment (FGA) ahead of more formal security analyses to help identify potential issues and can help to ensure that these devices meet essential Common Criteria requirements ahead of time.