Common Criteria for Information Technology Security Evaluation CC:2022 Revision 1 — Part 4

Note

Common Criteria CC:2022, revision 1, part 4: standardised framework for specifying objective, repeatable and reproducible evaluation methods and activities.

Summary

Purpose

Part 4 of the Common Criteria CC:2022, Revision 1 (November 2022), is new in this version CC:2022 R1 Part 4 CC:2022 R1 Part 1, Foreword. It sets a framework for writing evaluation methods and evaluation activities tailored to a type of product or technology:

It does not say how to evaluate, nor how to adopt or maintain these methods: those questions are left to those who write them CC:2022 R1 Part 4, § 1 Scope. It does not itself define any concrete method or activity CC:2022 R1 Part 4, Introduction.

Who it applies to

The framework is used by authors of protection profiles, packages and supporting documents, who may include evaluation methods or activities in them. When a security target identifies methods or activities to be used, the Common Evaluation Methodology (CEM) requires the evaluator to follow them and report on them CC:2022 R1 Part 4, Introduction.

No eIDAS act in the corpus refers to this part on its own (as observed on 30-10-2026). The implementing regulations on qualified trust services refer to the Common Criteria “version CC:2022, Parts 1 through 5” or to standard ISO/IEC 15408 Annex; these references are detailed in the summary of Part 1 CC:2022 R1 Part 1. The European EUCC scheme also includes this part in its definition of the Common Criteria Art. 2(1).

Key points

• Deriving from the CEM. The CEM defines generic “work units” that the evaluator performs to reach a verdict. Part 4 explains how to derive evaluation activities from them and group them into a method for a given context, for example a type of product or specific cryptographic functions CC:2022 R1 Part 4, § 4.1 Concepts and model.
• Mandatory identification. A protection profile or package that requires evaluation methods or activities says so. The security target lists all of them, without adding, modifying or removing any CC:2022 R1 Part 4, § 4.1 Concepts and model.
• No conformance claim to Part 4 in these cases CC:2022 R1 Part 4, § 4.1 Concepts and model.
• No errata. The errata and interpretation document, version 1.2, reports none for this part CCMB-2025-001 v1.2, Errata / Interpretation for CC:2022 Part 4.
• A use during transition. The CCRA transition policy suggests relying on the “Rationale for the Evaluation method/activity” sections of Part 4 to combine methods from a version 3.1 protection profile with CEM:2022 CCMC-2023-04-001, Protection Profiles.

Links

• Other parts: 1 CC:2022 R1 Part 1, 2 CC:2022 R1 Part 2, 3 CC:2022 R1 Part 3, 5 CC:2022 R1 Part 5; CEM:2022 methodology CEM:2022 R1.
• ISO/IEC 15408 and 18045 record ISO/IEC 15408 (1-5) and ISO/IEC 18045.
• Learning path: step 5, certification and standards.

Written by Asphalia.