Navigation * Home / Consultancy / Common Criteria (ISO 15408)

Common Criteria (ISO 15408)

The Common Criteria (CC) is an international standard (ISO 15408) for computer security. Its purpose is to allow users to specify their security requirements, to allow developers to specify the security attributes of their products, and to allow evaluators to determine if products actually meet their claims.

The CC defines a common set of potential security requirements, divided into functional requirements and assurance requirements. The CC also defines two kinds of documents that can be built using this common set:

Protection Profiles (PPs). A PP is a document created by a user or user community, and identifies user security requirements.

Security Targets (STs). An ST is a document, typically created by a system developer, that identifies the security capabilities of a particular product. An ST may claim to implement zero or more PPs.

Often, users desire an independent evaluation of a product (termed the Target of Evaluation, or TOE) to show that the product does, in fact, meet the claims in an ST. The CC is specifically written to support this independent evaluation.

The CC also predefines sets of assurance requirements, termed Evaluation Assurance Levels (EALs). These EALs are numbered 1 to 7, with higher EALs requiring increasing levels of evaluation effort. The notion is that higher EAL levels gain more assurance, but cost more time and money to independently evaluate. Higher EAL levels do not necessarily imply "better security", they only mean that the claimed security of the TOE has been more extensively validated.

Please contact us for more information on Common Criteria Consultancy, Solutions and Training