Common Criteria
What is Common Criteria?
An international standard (ISO/IEC 15408) for computer security certification that provides a framework for evaluating the security properties of IT products. Common Criteria evaluations are mutually recognised by 31 countries.
Terms that appear alongside common criteria
Each of these is named in at least one of the same controls as common criteria. The number is how many controls name both.
- cybersecurity 3 shared controls
- certification 2 shared controls
- iso 27001 2 shared controls
- compliance 2 shared controls
Frameworks that govern common criteria
What the standards actually require on common criteria
Requirements naming common criteria across 6 standards, quoted from the control text.
Mobile Device Management solutions that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Management, version 4.0 or later, are used to enforce mobile device management policy.
ISM-1195 · Common Criteria evaluated MDM solutions →Across all classifications, agencies should choose products in this ranked order: a product evaluated against a protection profile (PP);
new-zealand-information-security-manual-nzism::12.1.30.C.03 · 12.1.30.C.03 Preferred ranking when selecting evaluated products →The project establishes a development environment and practices sufficient for the assurance requirements, applied to the whole system and not only its security components: security engineering principles, secure coding and safe language standards, source and...
canada-itsg-33-it-security-risk-management::A2-3.7.1 · 3.7.1 Establish a secure development environment →The target of evaluation, two prepare-and-measure QKD modules (a transmitter and a receiver), is evaluated under Common Criteria CC:2022 to EAL4, augmented by AVA_VAN.5 (advanced methodical vulnerability analysis against attackers of high attack potential, cho...
etsi-industry-specification-group-isg-on-quantum-key-distribution-qkd::016.EAL · 016.EAL Assurance level EAL4 augmented with AVA_VAN.5 and ALC_DVS.2 →Article 15 requires competent authorities and the Commission to perform risk analyses on CBAM declarations and on declarant compliance, using common criteria, and to share results across Member States and with customs/tax/anti-fraud authorities.
CBAM-Art.15 · Risk analysis by competent authorities and the Commission (Article 15) →NSS-17 + NSS-42-G require supply chain + third party + OEM security across CBS lifecycle. Vendor due diligence: cyber maturity assessment + ISO 27001 / IEC 62443 / IEC 27036 alignment + cybersecurity governance + secure development + incident history + foreign...
IAEA-NSS17-SupplyChain-ThirdParty-OEM-Trust · IAEA NSS-17 - Supply Chain + Third Party + OEM + Vendor Security + Trustworthy Components →Questions people ask about common criteria
What is Common Criteria?
Why is Common Criteria important for compliance?
Which compliance frameworks address Common Criteria?
Where can I learn more about Common Criteria?
See how Common Criteria applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.