Common Criteria for Information Technology Security Evaluation CC:2022 Revision 1 — Part 2

Note

Common Criteria CC:2022, revision 1, part 2: structure and content of the security functional components, with a catalogue of components for evaluation.

Summary

Purpose

Part 2 of the Common Criteria CC:2022, Revision 1 (November 2022), is the catalogue of security functional components CC:2022 R1 Part 2:

These components are used to write the security functional requirements (SFRs) of a protection profile or a security target. They describe the expected security behaviour of the product evaluated, which a user can observe by interacting with it CC:2022 R1 Part 2, Introduction. Part 1 explains the overall model CC:2022 R1 Part 1.

Who it applies to

The document is aimed at three audiences: those who express a security need by choosing components, the developers who meet it, and the evaluators who check that the requirements of the profile or target are complete and consistent CC:2022 R1 Part 2, Introduction.

No eIDAS act in the corpus refers to this part on its own (as observed on 30-10-2026). The implementing regulations on qualified trust services refer to the Common Criteria “version CC:2022, Parts 1 through 5” or to standard ISO/IEC 15408, for certifying certain cryptographic devices Annex. The details of these references, act by act, are given in the summary of Part 1 CC:2022 R1 Part 1. The European EUCC scheme also includes this part in its definition of the Common Criteria Art. 2(1).

Key points

• Classes, families, components. The catalogue groups components into classes and families, by function or purpose, in alphabetical order and without a formal taxonomy CC:2022 R1 Part 2, § 7.2 Component catalogue.
• Eleven classes. Security audit (FAU), communication (FCO), cryptographic support (FCS), user data protection (FDP), identification and authentication (FIA), security management (FMT), privacy (FPR), protection of the security functions (FPT), resource utilisation (FRU), TOE access (FTA) and trusted paths or channels (FTP) CC:2022 R1 Part 2, § 8 Class FAU: Security audit CC:2022 R1 Part 2, § 18 Class FTP: Trusted path/channels.
• The cryptographic class. The FCS class is used when the product evaluated implements cryptographic functions, in hardware, firmware or software CC:2022 R1 Part 2, § 10.1 Class description.
• A corrected part. The errata and interpretation document maintained by the Common Criteria Maintenance Board (CCMB) has a section for this part CCMB-2025-001 v1.2 CCMB-2025-001 v1.2, Errata / Interpretation for CC:2022 Part 2.

Links

• Other parts: 1 CC:2022 R1 Part 1, 3 CC:2022 R1 Part 3, 4 CC:2022 R1 Part 4, 5 CC:2022 R1 Part 5; previous edition: CC v3.1 Revision 5, Part 2 CC v3.1 R5 Part 2.
• ISO/IEC 15408 and 18045 record ISO/IEC 15408 (1-5) and ISO/IEC 18045.
• Learning path: step 5, certification and standards.

Written by Asphalia.