Chapter I, Article 3 · EUCC

Contents

Article 3Evaluation standards#

1.The following standards shall apply to evaluations performed under the EUCC scheme:

2.Until 31 December 2027, a certificate may be issued under the EUCC scheme applying either of the following standards:

(a)ISO/IEC 15408-1:2009, ISO/IEC 15408-2:2008 or ISO/IEC 15408-3:2008;

(b)Common Criteria for Information Technology Security Evaluation, version 3.1, revision 5, published by the participants of the Arrangement on the Recognition of Common Criteria Certificates in the field of IT Security;

(c)ISO/IEC 18045:2008;

(d)Common Methodology for Information Technology Security Evaluation, revision 5, version 3.1, published by the participants of the Arrangement on the Recognition of Common Criteria Certificates in the field of IT Security.

3.Until 31 December 2027, a certificate applying the standards referred to in paragraph 1 may be issued under the EUCC scheme claiming conformance to a protection profile that has applied the standards listed in paragraph 2.

4.A certificate applying the standards referred to in paragraph 1 may also be issued under the EUCC scheme claiming conformance to a protection profile that has applied either of the following standards, provided that the use of such protection profile is required under Commission Implementing Regulation (EU) 2016/799^note, Regulation (EU) No 910/2014 of the European Parliament and of the Council^note or Commission Implementing Decision (EU) 2016/650^note:

(a)Common Criteria for Information Technology Security Evaluation, version 3.1, revision 1 to 4, published by the participants of the Arrangement on the Recognition of Common Criteria Certificates in the field of IT Security;

(b)Common Methodology for Information Technology Security Evaluation, version 3.1., revision 1 to 4, published by the participants of the Arrangement on the Recognition of Common Criteria Certificates in the field of IT Security.

Defined terms · 16

Show every defined term

certification body
means a conformity assessment body as defined in Article 2, point (13), of Regulation (EC) No 765/2008, which performs certification activities;
Common Criteria
means the Common Criteria for Information Technology Security Evaluation, as set out in standards ISO/IEC 15408-1:2022, ISO/IEC 15408-2:2022, ISO/IEC 15408-3:2022, ISO/IEC 15408-4:2022 or ISO/IEC 15408-5:2022, or set out in Common Criteria for Information Technology Security Evaluation, version CC:2022, Parts 1 through 5, published by the participants of the Arrangement on the Recognition of Common Criteria Certificates in the field of IT Security;
Common Evaluation Methodology
means the Common Methodology for Information Technology Security Evaluation, as set out in standard ISO/IEC 18045:2022, or the Common Methodology for Information Technology Security Evaluation, version CEM:2022, published by the participants of the Arrangement on the Recognition of Common Criteria Certificates in the field of IT Security;
composite product
means an ICT product that is evaluated together with another underlying ICT product that has already received an EUCC certificate and on whose security functionality the composite ICT product depends;
evaluation technical report
means a document produced by an ITSEF to present the findings, verdicts and justifications obtained during the evaluation of an ICT product or a protection profile in accordance with the rules and obligations set out in this Regulation;
ITSEF
means an Information Technology Security Evaluation Facility, which is a conformity assessment body as defined in Article 2, point (13), of Regulation (EC) No 765/2008 that performs evaluation tasks;
major change
means any change in the certified target of evaluation or its environment that may adversely impact the assurance expressed in the EUCC certificate.
market surveillance authority
means an authority defined in Article 3(4) of Regulation (EU) 2019/1020;
minor change
means any change in the certified target of evaluation or its environment that does not adversely impact the assurance expressed in the EUCC certificate;
national cybersecurity certification authority
means an authority designated by a Member State pursuant to Article 58(1) of Regulation (EU) 2019/881;
product series
means a set of ICT products by an applicant, built upon the same functional basis in order to address the same security needs, having a design, hardware, firmware or software which may vary from an ICT product to another;
protection profile
means an ICT process that lays down the security requirements for a specific category of ICT products, addressing implementation-independent security needs, and that may be used to assess ICT products falling into that specific category for the purpose of their certification;
security target
means a claim of implementation-dependent security requirements for a specific ICT product;
state-of-the-art document
means a document which specifies evaluation methods, techniques and tools that apply to the certification of ICT products, or security requirements of a generic ICT product category, or any other requirements necessary for certification, in order to harmonise evaluation, in particular of technical domains or protection profiles;
target of evaluation
means an ICT product or part thereof, or a protection profile as part of an ICT process, which is subjected to cybersecurity evaluation to receive EUCC certification;
technical domain
means a common technical framework related to a particular technology for the harmonised certification with a set of characteristic security requirements;