Common Criteria for Information Technology Security Evaluation CC:2022 Revision 1 — Part 5

Note

Common Criteria CC:2022, revision 1, part 5: predefined packages of assurance and security functional requirements, including the EAL assurance levels and the CAP composition packages.

Summary

Purpose

Part 5 of the Common Criteria CC:2022, Revision 1 (November 2022), is new in this version CC:2022 R1 Part 5 CC:2022 R1 Part 1, Foreword. It provides predefined packages of security requirements:

These packages include the evaluation assurance levels (EAL). Part 5 also defines packages for composed products (CAP), composite products (COMP), protection profile evaluation (PPA) and security target evaluation (STA) CC:2022 R1 Part 5, § 1 Scope.

Who it applies to

The packages can be cited in protection profiles and security targets; they are aimed at buyers, developers and evaluators of secure products CC:2022 R1 Part 5, § 1 Scope.

The implementing regulations on qualified trust services refer, for certain cryptographic devices, to certification under the Common Criteria or under the European EUCC scheme “to EAL 4 or higher”, or under FIPS PUB 140-3 level 3 until 31.12.2030 Annex. The effect of these references, act by act, is set out in the summary of Part 1 CC:2022 R1 Part 1. The acts refer to the Common Criteria “Parts 1 through 5”; they do not cite Part 5 on its own (as observed on 30-10-2026).

Key points

• Seven hierarchical levels. Each level, from EAL1 to EAL7, provides more assurance than the lower levels. One moves up a level by replacing an assurance component with a higher component from the same family or by adding components from other families CC:2022 R1 Part 5, § 4.3 Evaluation assurance level objectives.
• Augmentation. A level can be “augmented” with additional components; whoever does so must justify their usefulness. An EAL with one of its components removed is not recognised CC:2022 R1 Part 5, § 4.3 Evaluation assurance level objectives.
• A cost-assurance balance. The EALs form a scale that balances the level of assurance obtained against the cost or feasibility of obtaining it CC:2022 R1 Part 5, § 4.2.1 General.
• EAL4 (methodically designed, tested and reviewed). This is the highest level at which it is likely to be economically feasible to retrofit an existing product line. It is appropriate when moderate to high independently assured security is wanted in conventional products CC:2022 R1 Part 5, § 4.4.5.1 Package name CC:2022 R1 Part 5, § 4.4.5.3 Package overview. Its vulnerability analysis must demonstrate resistance to attackers possessing an “Enhanced-Basic” attack potential CC:2022 R1 Part 5, § 4.4.5.3 Package overview.
• The EUCC levels are linked to AVA_VAN levels: certificates at assurance level “substantial” cover AVA_VAN 1 or 2, those at level “high” AVA_VAN 3, 4 or 5 Art. 4.

Links

• Other parts: 1 CC:2022 R1 Part 1, 2 CC:2022 R1 Part 2, 3 CC:2022 R1 Part 3, 4 CC:2022 R1 Part 4.
• Errata and interpretation for this part CCMB-2025-001 v1.2, Errata / Interpretation for CC:2022 Part 5.
• ISO/IEC 15408 and 18045 record ISO/IEC 15408 (1-5) and ISO/IEC 18045.
• Learning path: step 5, certification and standards.

Written by Asphalia.