DataTerminology.comNEW
Also known as: ISO/IEC 15408, Common Criteria for Information Technology Security Evaluation, CC
An international standard (ISO/IEC 15408) for evaluating and certifying the security assurance of IT products and systems.
DESCRIPTION
Common Criteria is a globally recognized security evaluation standard used to assess and certify the assurance of IT products and systems. It defines security requirements via Protection Profiles and Security Targets and rates assurance with Evaluation Assurance Levels (EALs). Certifications recognized under the Common Criteria Recognition Arrangement (CCRA) help vendors demonstrate security rigor and help buyers compare products. National schemes, such as NIAP in the U.S., operate evaluations under the standard. While not a security guarantee, Common Criteria provides structured, evidence-based evaluation and documentation. It often complements other frameworks like ISO/IEC 27001 and NIST guidance. Adoption is common in government procurement and regulated industries. Evaluations can be time-consuming and costly but provide market credibility and compliance benefits.
ALTERNATIVE DEFINITIONS
Common Criteria Portal
The Common Criteria for Information Technology Security Evaluation (CC) is an international standard (ISO/IEC 15408) for computer security certification.
Highlights formal ISO/IEC designation and certification focus.
NIST CSRC Glossary
Common Criteria (CC) is an international standard (ISO/IEC 15408) that provides a framework in which users can specify security requirements, vendors can implement them, and evaluators can determine if they are met.
Emphasizes the roles of users, vendors, and evaluators in the framework.
ENISA
Common Criteria is a standard methodology for evaluating the security properties of IT products and systems against defined requirements and assurance levels.
Focuses on methodology and assurance levels from a European cybersecurity authority.
RELATED TERMS
Evaluation Assurance Level Protection Profile Security Target NIST RMF NIAP CCRA Assurance Case Conformance Testing
COMPETING TERMS
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Data Management AI Governance
TARGET AUDIENCE
Chief Information Security Officer Security Architect Cybersecurity Engineer IT Auditor IT Manager Chief Information Officer Chief Technology Officer Data Privacy Officer
EXTERNAL SOURCES
- Wikipedia - Common Criteria
- Common Criteria Portal - Official portal for CC and CCRA information
- NIAP - U.S. Common Criteria national scheme
- ISO - ISO/IEC 15408 standard page
- ENISA - EU perspective on CC evaluations
TOP QUESTIONS
What is Common Criteria and why is it important?
Common Criteria is an ISO/IEC standard for evaluating security assurance of IT products. It matters because it provides comparable, internationally recognized certification evidence.
Category: Relevancy
How do Evaluation Assurance Levels (EALs) work in Common Criteria?
EALs indicate the rigor of the evaluation from EAL1 (basic) to EAL7 (formally verified). Higher EALs require more evidence and formal methods, increasing cost and time.
Category: Concepts
What is a Protection Profile in Common Criteria?
A Protection Profile is a reusable set of security requirements and objectives for a product class. It guides evaluations to consistent, comparable outcomes across vendors.
Category: Concepts
Who recognizes Common Criteria certifications?
Countries participating in the Common Criteria Recognition Arrangement (CCRA) mutually recognize certificates. This reduces duplication across national markets.
Category: Governance
Is Common Criteria a guarantee of security?
No. It demonstrates that a product met specified requirements under a defined evaluation rigor. It’s assurance evidence, not a guarantee against future vulnerabilities.
Category: Misunderstanding
How does Common Criteria compare to FIPS 140-3?
Common Criteria addresses general IT security properties, while FIPS 140-3 specifically certifies cryptographic modules. They can complement each other in compliance.
Category: Alternatives
When should organizations pursue Common Criteria certification?
Pursue it when selling into government or regulated markets requiring CC, or when structured assurance evidence provides competitive advantage. Consider cost-benefit.
Category: Requirements
What are common pitfalls in Common Criteria evaluations?
Ambiguous Security Targets, underestimated documentation effort, and late threat modeling cause delays. Engage an experienced lab early and define scope precisely.
Category: Mistakes
How does Common Criteria relate to ISO/IEC 27001?
ISO/IEC 27001 certifies an organization’s ISMS, while Common Criteria evaluates product/system security. They address different assurance layers.
Category: Comparison