Common Methodology for Information Technology Security Evaluation CEM:2022 Revision 1

Note

Common Evaluation Methodology CEM:2022, revision 1: defines the minimum actions of the evaluator for conducting an evaluation under the Common Criteria.

Summary

Purpose

The Common Methodology for Information Technology Security Evaluation (CEM), in its version CEM:2022, Revision 1, accompanies the Common Criteria CEM:2022 R1:

It is the first major revision since CEM v3.1 Revision 5 of 2017. Like CC:2022, it was first developed as an ISO/IEC standard, then published by the participants in the Common Criteria Recognition Arrangement (CCRA); its ISO version is standard ISO/IEC 18045:2022 CEM:2022 R1, Foreword.

Who it applies to

It is aimed primarily at evaluators applying the Common Criteria and at certifiers who confirm their work. It does not answer every question: each certification scheme decides how to handle the necessary interpretations CEM:2022 R1, Introduction.

No eIDAS act in the corpus cites CEM:2022 or standard ISO/IEC 18045:2022 by name (as observed on 30-10-2026). The link runs through the European EUCC scheme:

• Implementing Regulation 2024/482 defines the “common evaluation methodology” as standard ISO/IEC 18045:2022 or version CEM:2022 published by the participants in the recognition arrangement Art. 2(2), and applies it to evaluations carried out under EUCC Art. 3(1);
• several eIDAS implementing regulations accept a secure cryptographic device certified under EUCC to EAL 4 or higher Annex; the details are given in the summary of Part 1 of the Common Criteria CC:2022 R1 Part 1.

Key points

• The main changes: “exact” conformance type, direct rationale protection profiles, modular evaluations, “multi-assurance” evaluation and assurance composition CEM:2022 R1, Foreword.
• Three verdicts. Pass, fail or inconclusive; every verdict is initially inconclusive. The overall verdict is a pass only if all the verdicts that make it up are passes CEM:2022 R1, § 9.1.5 Evaluator verdicts.
• Attack potential. An annex explains how to calculate the attack potential, which is used in vulnerability analysis CEM:2022 R1, Determining the attack potential CEM:2022 R1, Calculation of attack potential.
• A value taken up for the wallet. Annex Ib to Implementing Regulation 2024/2979 requires the value iso_18045_high for key storage and user authentication where a key attestation refers to the wallet secure cryptographic device (WSCD) Annex Ib. OpenID4VCI links this value to the “High” attack potential within the meaning of ISO/IEC 18045 OpenID4VCI 1.0, [D.2.](#appendix-D.2) [Attack Potential Resistance](#name-attack-potential-resistance).
• The previous edition. Implementing Decision 2016/650 still cites ISO/IEC 18045:2008 for the evaluation of qualified signature and seal creation devices Annex; until 31 December 2027, an EUCC certificate may still be issued by applying the 2008 edition or CEM 3.1 Revision 5 Art. 3(2).

Links

• Common Criteria CC:2022: Parts 1 to 5 CC:2022 R1 Part 1 CC:2022 R1 Part 2 CC:2022 R1 Part 3 CC:2022 R1 Part 4 CC:2022 R1 Part 5; errata CCMB-2025-001 v1.2, Errata / Interpretation for CEM:2022; CEM v3.1 Revision 5 CEM v3.1 R5.
• ISO/IEC 15408 and 18045 record ISO/IEC 15408 (1-5) and ISO/IEC 18045.
• Learning path: step 5, certification and standards.

Written by Asphalia.