Chapter II, Section II, Article 11 · EUCC

Contents

Article 11Mark and label#

1.The holder of a certificate may affix a mark and label to a certified ICT product. Mark and label demonstrate that the ICT product has been certified in accordance with this Regulation. Mark and label shall be affixed in accordance with this Article and with Annex IX.

2.The mark and label shall be affixed visibly, legibly and indelibly to the certified ICT product or its data plate. Where that is not possible or not warranted on account of the nature of the product, it shall be affixed to the packaging and to the accompanying documents. Where the certified ICT product is delivered in the form of software, the mark and label shall visibly, legibly and indelibly appear in its accompanying documentation or this documentation shall be made easily and directly accessible to users by means of a website.

3.The mark and label shall be set out as in Annex IX and contain:

(a)the assurance level and the AVA_VAN level of the certified ICT product;

(b)the unique identification of the certificate, consisting of:

(1)the name of the scheme;

(2)the identification number, in accordance with Article 3 of Implementing Regulation (EU) 2024/3143, of the certification body that has issued the certificate;

(3)year of issuance of the initial certificate;

(4)identification number assigned by the certification body that has issued the certificate.

4.The mark and label shall be accompanied by a QR code with a link to a website containing at least:

(a)the information on the validity of the certificate;

(b)the necessary certification information as set out in Annexes V and VII;

(c)the information to be made publicly available by the holder of the certificate in accordance with Article 55 of Regulation (EU) 2019/881; and

(d)where applicable, the historic information related to the specific certification or certifications of the ICT product to enable traceability.

Defined terms · 16

Show every defined term

certification body
means a conformity assessment body as defined in Article 2, point (13), of Regulation (EC) No 765/2008, which performs certification activities;
Common Criteria
means the Common Criteria for Information Technology Security Evaluation, as set out in standards ISO/IEC 15408-1:2022, ISO/IEC 15408-2:2022, ISO/IEC 15408-3:2022, ISO/IEC 15408-4:2022 or ISO/IEC 15408-5:2022, or set out in Common Criteria for Information Technology Security Evaluation, version CC:2022, Parts 1 through 5, published by the participants of the Arrangement on the Recognition of Common Criteria Certificates in the field of IT Security;
Common Evaluation Methodology
means the Common Methodology for Information Technology Security Evaluation, as set out in standard ISO/IEC 18045:2022, or the Common Methodology for Information Technology Security Evaluation, version CEM:2022, published by the participants of the Arrangement on the Recognition of Common Criteria Certificates in the field of IT Security;
composite product
means an ICT product that is evaluated together with another underlying ICT product that has already received an EUCC certificate and on whose security functionality the composite ICT product depends;
evaluation technical report
means a document produced by an ITSEF to present the findings, verdicts and justifications obtained during the evaluation of an ICT product or a protection profile in accordance with the rules and obligations set out in this Regulation;
ITSEF
means an Information Technology Security Evaluation Facility, which is a conformity assessment body as defined in Article 2, point (13), of Regulation (EC) No 765/2008 that performs evaluation tasks;
major change
means any change in the certified target of evaluation or its environment that may adversely impact the assurance expressed in the EUCC certificate.
market surveillance authority
means an authority defined in Article 3(4) of Regulation (EU) 2019/1020;
minor change
means any change in the certified target of evaluation or its environment that does not adversely impact the assurance expressed in the EUCC certificate;
national cybersecurity certification authority
means an authority designated by a Member State pursuant to Article 58(1) of Regulation (EU) 2019/881;
product series
means a set of ICT products by an applicant, built upon the same functional basis in order to address the same security needs, having a design, hardware, firmware or software which may vary from an ICT product to another;
protection profile
means an ICT process that lays down the security requirements for a specific category of ICT products, addressing implementation-independent security needs, and that may be used to assess ICT products falling into that specific category for the purpose of their certification;
security target
means a claim of implementation-dependent security requirements for a specific ICT product;
state-of-the-art document
means a document which specifies evaluation methods, techniques and tools that apply to the certification of ICT products, or security requirements of a generic ICT product category, or any other requirements necessary for certification, in order to harmonise evaluation, in particular of technical domains or protection profiles;
target of evaluation
means an ICT product or part thereof, or a protection profile as part of an ICT process, which is subjected to cybersecurity evaluation to receive EUCC certification;
technical domain
means a common technical framework related to a particular technology for the harmonised certification with a set of characteristic security requirements;