(title available in French only)
Official Binding
Note
Common Criteria CC:2022, revision 1, part 1: general concepts and principles of IT product security evaluation, the general evaluation model and the notion of target of evaluation (TOE).
The full text is not reproduced here (copyright): see the official source.
Summary
Purpose
The Common Criteria (CC) are used to evaluate the security of IT products. Part 1 of their version CC:2022, Revision 1 (November 2022), provides the introduction and general model CC:2022 R1 Part 1:
This document establishes the general concepts and principles of IT security evaluation and specifies the general model of evaluation given by various parts of the standard which in its entirety is meant to be used as the basis for evaluation of security properties of IT products.
It defines the target of evaluation (TOE, the product evaluated), protection profiles (PP, requirements for a category of products) and security targets (ST, requirements for a given product). It also presents the other parts: functional components (Part 2), assurance components (Part 3), framework for evaluation methods (Part 4) and predefined evaluation assurance levels, EAL (Part 5) CC:2022 R1 Part 1, § 1 Scope. The evaluation methodology itself is a separate document, the CEM, and the evaluation of cryptographic algorithms is not covered CC:2022 R1 Part 1, Introduction.
CC:2022 was first developed as an ISO/IEC standard, then published by the participants in the Common Criteria Recognition Arrangement (CCRA). The ISO version is the series ISO/IEC 15408-1 to 15408-5:2022 CC:2022 R1 Part 1, Foreword.
Who it applies to
Implementing Regulation 2024/482 (European EUCC scheme) defines the “Common Criteria” as standards ISO/IEC 15408-1 to -5:2022 or version CC:2022, Parts 1 to 5, published by the participants in the recognition arrangement Art. 2(1). Several eIDAS implementing regulations take up this dual reference. They accept a secure cryptographic device certified under the Common Criteria at level EAL 4 or higher, or under EUCC, or under FIPS PUB 140-3 level 3 until 31.12.2030 List of reference standards and specifications for qualified time stamp services:
| Act and annex | Adapted standard | Requirement | Intended effect |
|---|---|---|---|
| 2025/1929 List of reference standards and specifications for qualified time stamp services | ETSI EN 319 421 V1.3.1 ETSI EN 319 421 V1.3.1 | TIS-7.6.2-03, TIS-7.6.3-02 | presumption (binding of date and time, and time source) Art. 42(1a) |
| 2025/1942 Annex | ETSI TS 119 441 V1.2.1 ETSI TS 119 441 V1.2.1 | OVR-7.5-03 (conditional) | presumption (validation service) Art. 33(2) Art. 40 |
| 2025/1943 Annex I Annex II | ETSI EN 319 411-2 V2.6.1 ETSI EN 319 411-2 V2.6.1 | GEN-6.5.2-02 | presumption (qualified certificate) Art. 28(6) Art. 38(6) |
| 2025/1944 List of reference standards and specifications referred to in Article 1 | ETSI EN 319 521 V1.1.1 ETSI EN 319 521 V1.1.1 | REQ-ERDSP-7.5-03 | presumption (process for sending and receiving data) Art. 44(1a) |
| 2025/1946 List of reference standards and specifications referred to in Article 2 | ETSI TS 119 511 V1.1.1 ETSI TS 119 511 V1.1.1 | OVR-7.5-05 (conditional) | presumption (preservation service) Art. 34(1a) Art. 40 |
| 2025/2531 List of technical specifications and reference standards for qualified distributed electronic ledgers | ETSI EN 319 401 V3.1.1 ETSI EN 319 401 V3.1.1 | REQ-7.5-06 | presumption (electronic ledger) Art. 45l(2) |
| 2025/2532 List of reference standards and specifications for qualified electronic archiving services | CEN/TS 18170:2025 CEN/TS 18170:2025 | cryptographic controls (§ 7.6), conditional | presumption (archiving service) Art. 45j(2) |
| 2025/1569 Annex I | ETSI TS 119 471 V1.1.1 ETSI TS 119 471 V1.1.1 | REQ-EAASP-7.5.3-02 | obligation for both categories of providers Art. 3; “deemed” for public sector attestations Art. 45f(5) |
In the “intended effect” column, “presumption” refers to the exact word of the regulation: what is indicated in brackets is “presumed” to comply with the requirements concerned where it meets these standards, specifications and procedures; the requirement remains that of the regulation. Annex I to Implementing Regulation 2025/1569 follows a different pattern. Providers of qualified electronic attestations of attributes and providers of attestations issued by or on behalf of a public sector body responsible for an authentic source are required to comply with the standards in that annex Art. 3. For qualified attestations, the empowering article contains no presumption sentence Art. 45d(5). For public sector attestations, the regulation uses another word: the attestation is “deemed” to be compliant with the requirements laid down in paragraph 1 of the article where it complies with the standards, specifications and procedures referred to in paragraph 6 Art. 45f(5). Implementing Regulation 2026/1735, which replaced that annex, is adopted in particular on the basis of that paragraph 6 amending Implementing Regulation (EU) 2025/1569 as regards applicable standards and specifications. Details of the protected keys are given in the summary of FIPS PUB 140-3 FIPS PUB 140-3.
Key points
- Level EAL 4. The acts require certification “to EAL 4 or higher” Annex; this level is defined in Part 5 CC:2022 R1 Part 5, § 4.4.5.1 Package name.
- No revision specified. The acts cite “CC:2022, Parts 1 through 5” without a revision number Annex; the corpus contains Revision 1 CC:2022 R1 Part 1.
- Version 3.1 for a time. Annex I to Implementing Regulation 2025/1569, which is binding on providers of qualified electronic attestations of attributes and on providers of attestations issued by or on behalf of a public sector body responsible for an authentic source Art. 3, also accepts version 3.1 “until 31.08.2027” Annex I; see CC v3.1 Revision 5 CC v3.1 R5 Part 1.
- The wallet. Implementing Regulation 2024/2981 provides for a vulnerability assessment at level AVA_VAN.5 within the meaning of EN ISO/IEC 15408-3:2022, unless duly justified to the certification body. It applies to the wallet secure cryptographic application (WSCA) and, where the conditions laid down in the regulation are met Art. 3(3)(b), to all or part of the wallet secure cryptographic device (WSCD) § 2. Evaluation activities related to the wallet secure cryptographic device § 3. Evaluation activities related to the wallet secure cryptographic application (WSCA); see Part 3 CC:2022 R1 Part 3.
Links
- Other parts: 2 CC:2022 R1 Part 2, 3 CC:2022 R1 Part 3, 4 CC:2022 R1 Part 4, 5 CC:2022 R1 Part 5; CEM:2022 methodology CEM:2022 R1; errata CCMB-2025-001 v1.2; ISO/IEC 15408 and 18045 record ISO/IEC 15408 (1-5) and ISO/IEC 18045.
- Learning path: step 5, certification and standards.
Cited version
Several acts in the table cite an intermediate standard in a version older than the latest published one according to the index of ETSI standards in the corpus, consulted on 31-10-2026: ETSI TS 119 441 V1.2.1 (2025/1942; index: V1.3.1) Annex ETSI TS 119 441 V1.2.1, ETSI TS 119 511 V1.1.1 (2025/1946; index: V1.2.1) List of reference standards and specifications referred to in Article 2 ETSI TS 119 511 V1.1.1, ETSI EN 319 401 V3.1.1 (2025/2531) List of technical specifications and reference standards for qualified distributed electronic ledgers ETSI EN 319 401 V3.1.1, of which V3.2.1 is in the corpus ETSI EN 319 401 V3.2.1. The acts name the versions indicated. Some acts in the corpus refer to the 2022 edition of ISO/IEC 15408, of which CC:2022 is the counterpart published by the participants of the Arrangement on the Recognition of Common Criteria Certificates Art. 2(1). According to our fact sheet, drawn up on 29-10-2026, the ISO edition in force is that of 2026, and the 2022 edition is withdrawn § 1. Identification.
Error in the act
In several of these annexes, the Common Criteria route refers to “version CC:2002, Parts 1 through 5”: requirement TIS-7.6.3-02 of Implementing Regulation 2025/1929, requirement GEN-6.5.2-02 of Annexes I and II to Implementing Regulation 2025/1943, requirement REQ-ERDSP-7.5-03 of Implementing Regulation 2025/1944. The English version of these acts carries the same mention List of reference standards and specifications for qualified time stamp services Annex I Annex II List of reference standards and specifications referred to in Article 1. This is probably version CC:2022, which requirement TIS-7.6.2-03 of Implementing Regulation 2025/1929 cites in identical wording List of reference standards and specifications for qualified time stamp services. This reading is ours, not an official correction. The heading of Annex II to Implementing Regulation 2025/1943 refers, in French, to “certificats qualifiés de signature électronique” (qualified certificates for electronic signatures); the English version says electronic seals, and this annex corresponds to qualified certificates for electronic seals Annex II Art. 1. Probable reading of the French version: “certificats qualifiés de cachet électronique”.
Consolidation without official value
This summary cites the consolidated versions of Regulation 910/2014 and of Implementing Regulations 2024/482 and 2025/1569 published on EUR-Lex Regulation (EU) No 910/2014 — consolidated version of 18/10/2024 Implementing Regulation (EU) 2024/482 — consolidated version of 29/12/2025 Implementing Regulation (EU) 2025/1569 — consolidated version of 11/08/2026. They serve as documentation: only the texts published in the Official Journal are authentic.
Written by Asphalia.