Common Criteria for Information Technology Security Evaluation v3.1 Revision 5 — Part 2

Note

Common Criteria v3.1, revision 5, part 2: structure and content of the security functional components, with a catalogue of components for evaluation.

Summary

Purpose

Part 2 of the Common Criteria, version 3.1 revision 5 (reference CCMB-2017-04-002), is the catalogue of security functional components of that version CC v3.1 R5 Part 2:

These components are used to write the security functional requirements of a protection profile or a security target: they describe the security behaviour expected of the evaluated product, in the face of the threats in its operational environment CC v3.1 R5 Part 2, § 1 Introduction. Part 1 of the same version provides the overall model CC v3.1 R5 Part 1.

Who it applies to

The document is addressed to consumers who express a need, developers who respond to it and evaluators who check the requirements of a profile or a target CC v3.1 R5 Part 2, § 1 Introduction.

In the corpus, version 3.1 is now accepted only for limited periods: by the European EUCC scheme until 31 December 2027 for revision 5 Art. 3(2), and by Implementing Regulation 2025/1569 “until 31.08.2027”, for providers of qualified electronic attestations of attributes and providers of attestations issued by or on behalf of a public sector body responsible for an authentic source Art. 3 Annex I. These rules, and the rule on version 3.1 protection profiles, are detailed in the summary of Part 1 CC v3.1 R5 Part 1. None of these texts refers to Part 2 on its own (finding as at 30-10-2026).

Implementing Decision 2016/650 for its part cites standard ISO/IEC 15408-2:2008, and not CC 3.1 Annex; the comparison between these texts is given in a sheet written by us ISO/IEC 15408 (1-5) and ISO/IEC 18045.

Key points

• Classes of components, from security audit (FAU) to resource utilisation (FRU), including user data protection (FDP) and identification and authentication (FIA) CC v3.1 R5 Part 2, § 8 Class FAU: Security audit CC v3.1 R5 Part 2, § 11 Class FDP: User data protection CC v3.1 R5 Part 2, § 12 Class FIA: Identification and authentication CC v3.1 R5 Part 2, § 16 Class FRU: Resource utilisation.
• The cryptographic class. In this version, the FCS class has two families: cryptographic key management (FCS_CKM) and cryptographic operation (FCS_COP) CC v3.1 R5 Part 2, § 10 Class FCS: Cryptographic support. In CC:2022, the same class has four CC:2022 R1 Part 2, § 10.1 Class description.
• A transition governed by the CCRA. Revision 5 could be used for evaluations started no later than 30 June 2024, subject to the other rules of the transition policy CCMC-2023-04-001, _Introduction_ ~~es~~.

Links

• Part 1 of the same version CC v3.1 R5 Part 1; current version CC:2022, Part 2 CC:2022 R1 Part 2.
• CCRA transition policy CCMC-2023-04-001; ISO/IEC 15408 and 18045 sheet ISO/IEC 15408 (1-5) and ISO/IEC 18045.
• Learning path: step 5, certification and standards.

Written by Asphalia.