Common Criteria Standards

By /

🌐 Evolving Standards: Common Criteria and the Globalization of Security Practices

By James K. Bishop, vCISO | Founder, Stage Four Security

By the mid-1990s, different countries had developed their own frameworks for evaluating the security of computer systems. The U.S. had the Orange Book. Europe had ITSEC. Canada had CTCPEC. Each was rigorous, but fragmented. The need for a unified, globally recognized standard gave rise to the Common Criteria for Information Technology Security Evaluation.

Today, Common Criteria is the most widely adopted international standard for product assurance—governing how governments procure security tech and how vendors prove their claims.

🌍 What Is Common Criteria?

  • Full name: ISO/IEC 15408
  • Purpose: Standardize the evaluation of IT products for security functionality and assurance
  • Recognition: Over 30 nations participate in the Common Criteria Recognition Arrangement (CCRA)
  • Scope: Applies to OSes, network devices, smart cards, databases, mobile security components, and more

🔐 Key Concepts in Common Criteria

  • Target of Evaluation (TOE): The specific product or system being evaluated
  • Security Target (ST): The vendor’s documentation describing what the product claims to do and how
  • Protection Profile (PP): A predefined baseline set of security requirements for product categories (e.g., firewalls, smart cards)
  • Evaluation Assurance Levels (EALs): Ranges from EAL1 (basic) to EAL7 (formally verified)—each increasing in depth, rigor, and cost

🏛️ Why It Mattered

  • Cross-border trust: Governments could rely on evaluations done by partners (e.g., France accepting a U.S. certification)
  • Vendor alignment: Gave developers a globally understood roadmap for security design and documentation
  • Procurement validation: Allowed agencies to enforce a bar of evidence—not just marketing—when purchasing tech
  • Reinforced assurance culture: Echoed the Rainbow Series by prioritizing not just “what the product does” but “how we know it does it securely”

🔁 Real-World Use Cases

  • Military-grade OSes: SELinux and Secure Trusted Operating Systems evaluated under Common Criteria to high EALs
  • Firewalls and routers: Government procurement often requires a certified TOE and alignment with Protection Profiles
  • Smartcards & cryptographic modules: CC often layered with FIPS 140-2 in hardware-level evaluations
  • Mobile security: Samsung Knox and Apple Secure Enclave both mapped to Common Criteria in their assurance claims

⚖️ Limitations and Criticisms

  • Slow and costly: High-assurance evaluations can take years and hundreds of thousands of dollars
  • Static documentation: Requires extensive paperwork that may lag behind product iterations
  • Not always “real-world ready”: Critics argue it favors formalism over dynamic, threat-based evaluation

That said, Common Criteria’s rigor makes it ideal for environments where failure is unacceptable—nuclear control systems, financial infrastructure, national defense, and diplomatic communications.

📣 Final Thought

Common Criteria taught the security industry that trust isn’t a feeling—it’s an outcome of formalized process, rigorous evidence, and global collaboration. While newer models like FedRAMP, NIST 800-171, and ISO 27001 have gained momentum, they all carry the DNA of what CC pioneered: that proving security matters just as much as claiming it.

Need help interpreting certifications, evaluating vendors, or building security into your product lifecycle? Let’s talk.

Scroll to Top