Transition Policy to CC:2022 and CEM:2022

Note

Common Criteria Recognition Arrangement policy (CCMC-2023-04-001, 20 April 2023) aiming at an orderly transition from Common Criteria v3.1 to CC:2022 and CEM:2022.

Summary

Purpose

Document CCMC-2023-04-001 of the Management Committee of the Common Criteria Recognition Arrangement (CCRA), dated 20 April 2023, sets the transition policy from version 3.1 of the Common Criteria to CC:2022 and CEM:2022 CCMC-2023-04-001:

It states until when a product or protection profile certification based on CC v3.1 revision 5 may be started or reused, and in which cases results obtained under one version may be used in a certification under the other CCMC-2023-04-001, _Introduction_ ~~es~~.

Who it applies to

The policy is aimed at developers, evaluation facilities (ITSEF) and certification bodies working within the CCRA CCMC-2023-04-001, _Introduction_ ~~es~~. A certification body may depart from it in exceptional cases, which should remain rare and indispensable CCMC-2023-04-001, Exceptions.

No act in the corpus, consulted on 30-10-2026, cites this policy. Union law lays down its own transition rules, not to be confused with it:

• The EUCC. Until 31 December 2027, an EUCC certificate may still be issued on the basis of the earlier editions (ISO/IEC 15408:2008/2009, ISO/IEC 18045:2008, Common Criteria and common methodology 3.1 revision 5) Art. 3(2). Until the same date, a certificate based on the 2022 standards may certify conformity with a protection profile established under those earlier editions Art. 3(3). With no date in the article, a certificate based on the 2022 standards may also certify conformity with a protection profile established under Common Criteria 3.1, revisions 1 to 4, where the use of that profile is required in particular by Regulation 910/2014 or by Implementing Decision 2016/650 Art. 3(4).
• Qualified electronic attestations of attributes and those of the public sector. Annex I to Implementing Regulation 2025/1569 is binding on the providers of these two categories of attestations Art. 3. That annex accepts Common Criteria version 3.1 “until 31.08.2027” Annex I.

Key points

• Three basic rules, adopted after the publication of CC:2022 in November 2022 CCMC-2023-04-001, _Introduction_ ~~es~~:
  • revision 5 is the last revision of version 3.1; it may be used for product and protection profile evaluations started no later than 30 June 2024;
  • a security target conformant with CC:2022 and based on a protection profile certified under CC v3.1 is accepted until 31 December 2027;
  • after 30 June 2024, re-evaluations and re-assessments based on a CC v3.1 evaluation may be started for two years from the date of the initial certification.
• A longer period for exact conformance. A product certification under CC v3.1 revision 5, against a protection profile requiring exact conformance, may be started until 31 December 2025 CCMC-2023-04-001, Initial certifications.
• Cross-reuse. A CC:2022 certification may reuse life-cycle evaluation results (ALC class) obtained under CC v3.1 revision 5, and a 3.1 revision 5 platform certificate may be used in a CC:2022 composite certification CCMC-2023-04-001, ALC Evaluation Results CCMC-2023-04-001, Composite Certifications.
• Version 3.1 profiles. The document gives recommendations for resolving conflicts between a CC:2022 target and a 3.1 profile, and states that the certification body should ensure, if it departs from them, that the assurance level is not reduced CCMC-2023-04-001, Protection Profiles.

Links

• Versions concerned: CC v3.1 revision 5, Parts 1 and 2 CC v3.1 R5 Part 1 CC v3.1 R5 Part 2; CC:2022 CC:2022 R1 Part 1; CEM:2022 CEM:2022 R1.
• Learning path: step 5, certification and standards.

Written by Asphalia.