Common Criteria for Information Technology Security Evaluation v3.1 Revision 5 — Part 1

Note

Common Criteria v3.1, revision 5, part 1: general concepts and principles of IT product security evaluation, the general evaluation model and the notion of target of evaluation (TOE).

Summary

Purpose

Part 1 of the Common Criteria, version 3.1 revision 5 (April 2017, reference CCMB-2017-04-001), provides the introduction and general model of the security evaluation of IT products CC v3.1 R5 Part 1. Version 3.1 has three parts: introduction and general model, functional components, assurance components CC v3.1 R5 Part 1, Foreword.

This part defines the target of evaluation (TOE), protection profiles (PP), packages of requirements and the notion of conformance; it guides the writing of security targets (ST) and refers to the CEM for the evaluation methodology CC v3.1 R5 Part 1, § 2 Scope. The governments holding the rights have authorised ISO/IEC to use CC 3.1 for the development and maintenance of standard ISO/IEC 15408 CC v3.1 R5 Part 1, _Legal Notice:_.

CC:2022 presents itself as the first major revision since this version 3.1 revision 5; its new Parts 4 and 5 are described there as a substantial improvement CC:2022 R1 Part 1, Foreword.

Who it applies to

Version 3.1 is now cited only for limited periods or for existing protection profiles, with four distinct wordings in the corpus:

• The EUCC, revision 5. Until 31 December 2027, an EUCC certificate may still be issued applying the Common Criteria “version 3.1, revision 5” Art. 3(2).
• The EUCC, profiles established under revision 5. Until 31 December 2027, a certificate based on the 2022 standards may certify conformity with a protection profile established under the earlier standards, including Common Criteria 3.1 revision 5 Art. 3(3) Art. 3(2).
• The EUCC, revisions 1 to 4, for profiles. With no date limit in the article, a certificate based on the 2022 standards may certify conformity with a protection profile established under version 3.1, revisions 1 to 4, provided that the use of that profile is required in particular by Regulation 910/2014 or by Implementing Decision 2016/650 Art. 3(4). For example, protection profile EN 419211-2, cited by that decision, claims conformance with Common Criteria 3.1, revision 3 Annex BSI-CC-PP-0059 (EN 419211-2), § 6.1 CC Conformance Claim.
• Qualified electronic attestations of attributes and those of the public sector. Annex I to Implementing Regulation 2025/1569 is binding on the providers of these two categories of attestations Art. 3. That annex accepts Common Criteria version 3.1 (CC3.1) until 31.08.2027, without specifying a revision Annex I.

Implementing Decision 2016/650, which sets the standards for the security assessment of qualified signature and seal creation devices, for its part cites standard ISO/IEC 15408-1:2009, and not CC 3.1 Annex. The comparison between the two texts is given in a sheet written by us ISO/IEC 15408 (1-5) and ISO/IEC 18045.

Key points

• A shorter CCRA deadline. According to the CCRA transition policy, revision 5 may be used for evaluations started no later than 30 June 2024; CC:2022 targets based on a profile certified under CC v3.1 are accepted until 31 December 2027 CCMC-2023-04-001, _Introduction_ ~~es~~.
• Three dates not to be confused: 30 June 2024 (CCRA, new evaluations), 31 August 2027 (Implementing Regulation 2025/1569) and 31 December 2027 (EUCC) CCMC-2023-04-001, _Introduction_ ~~es~~ Annex I Art. 3(2).

Links

• Part 2 of the same version CC v3.1 R5 Part 2; current version CC:2022, Part 1 CC:2022 R1 Part 1.
• CCRA transition policy CCMC-2023-04-001; ISO/IEC 15408 and 18045 sheet ISO/IEC 15408 (1-5) and ISO/IEC 18045.
• Learning path: step 5, certification and standards.

Written by Asphalia.