European Common Criteria-based cybersecurity certification framework, EUCC

It is based on the Common Criteria (ISO/IEC 15408) and the Common Methodology for Evaluation (ISO/IEC 18045), which are international standards that provide a framework for assessing the security properties of Information Technology (IT) products and systems.

These criteria and methodologies ensure that evaluations are rigorous and standardized at an international level.

It offers two levels of assurance: substantial and high.

The level of assurance determines the depth and rigor of the evaluation, taking into account the resistance to different threat profiles. For example, the substantial level corresponds to the assurance requirements AVA_VAN. 1 or 2, while the high level corresponds to the assurance requirements AVA_VAN. 3, 4 or 5.

ICT products are certified based on their security objectives, which may incorporate certified protection profiles, if applicable.

Certification at the high assurance level must be based on the Technical Domains defined in the Framework or protection profiles adopted as state-of-the-art documents.

Applicants must provide complete documentation, including the results of previous evaluations if applicable, to support the certification process.

Certification bodies will issue certificates if all conditions are met, and these certificates will include specific information detailed in Annex VII of the regulation.

This allows certificates issued under the EUCC framework to be recognized in all EU member states, facilitating the free movement of certified ICT products and services.

The EUCC guidelines, the state of the art of the EUCC, and other documents related to the framework are published on the official website of the Certification Agency of the European Union for Cybersecurity (ENISA).

Any manufacturer or provider wishing to assess the security quality of ICT products can apply for certification under the EUCC.

As a general rule, the first step is to select a Conformity Assessment Body (CAB) that is accredited by the National Accreditation Entity (ENAC) and notified by an ANCC to the European Commission, and for the high level, also authorized by the ANCC. ITSEF.

For the high level of assurance, the Certification Body of the ANCC in Spain will be responsible of issuing the EUCC certificates and the applicant must select a laboratory accredited by ENAC and authorized by the ANCC to carry out the necessary evaluation activities. ITSEF

The EUCC framework covers a wide range of security requirements, offering two levels of assurance defined in the CSA: Considerable and High. These levels of assurance in the EUCC framework are directly related to the AVA_VAN security assurance requisites, which are defined in the Common Criteria regulation, against which a product will be assessed, and should not be confused with the Assurance Level (EAL).

The EUCC certificates at the Considerable assurance level correspond to certificates that include the AVA_VAN assurance requisites 1 or 2. The EUCC certificates at the High assurance level correspond to certificates that include AVA_VAN assurance requisites 3 to 5.

Currently, there is an agreement among the seventeen European member states aimed at recognizing each other's Common Criteria certificates. This recognition agreement was established by SOG-IS, a working group of the European Commission. The EUCC is the successor to SOG-IS and extends recognition by these member states to a certificate that is recognized by all European Member States.