Common Methodology for Information Technology Security Evaluation v3.1 Revision 5

Note

Common Evaluation Methodology CEM v3.1, revision 5: companion document to the Common Criteria, which defines the minimum actions of the evaluator, excluding certain high-assurance components.

Summary

Purpose

The Common Methodology for Information Technology Security Evaluation (CEM), version 3.1 revision 5 (reference CCMB-2017-04-004), accompanies the Common Criteria of the same version CEM v3.1 R5:

It does not define evaluator actions for certain high assurance components, for lack of generally accepted guidance CEM v3.1 R5, § 2 Scope. The governments holding the rights have authorised ISO/IEC to use CEM 3.1 to develop and maintain standard ISO/IEC 18045 CEM v3.1 R5, _Legal Notice:_.

Who it applies to

It is addressed primarily to evaluators applying the Common Criteria and to certifiers who confirm their work; sponsors, developers and authors of protection profiles or security targets are a secondary audience. It does not answer every question: each scheme decides how to handle the interpretations needed CEM v3.1 R5, § 1 Introduction.

In the corpus, CEM 3.1 is now accepted only in defined cases, by the European EUCC scheme:

• until 31 December 2027, an EUCC certificate may still be issued applying the “Common Methodology for Information Technology Security Evaluation, revision 5, version 3.1” Art. 3(2);
• until the same date, a certificate based on the 2022 standards may certify conformity with a protection profile established under those version 3.1 standards Art. 3(3);
• with no date in the article, a certificate based on the 2022 standards may certify conformity with a protection profile established under the common methodology version 3.1, revisions 1 to 4, if the use of that profile is required in particular by Regulation 910/2014 or Implementing Decision 2016/650 Art. 3(4).

Annex I to Implementing Regulation 2025/1569 accepts the Common Criteria “version 3.1 (CC3.1) until 31.08.2027”, but does not name the evaluation methodology Annex I (finding as at 31-10-2026). Implementing Decision 2016/650 cites standard ISO/IEC 18045:2008, and not CEM 3.1 Annex; the comparison between these texts is given in a sheet written by us ISO/IEC 15408 (1-5) and ISO/IEC 18045.

Key points

• An organisation by assurance class. Chapter 9 deals with the evaluation of a protection profile, chapters 11 to 17 with the evaluation activities by assurance class CEM v3.1 R5, § 6.1 Organisation of the CEM.
• Attack potential. Annex B explains the criteria for vulnerability analysis and gives examples of their application CEM v3.1 R5, § 6.1 Organisation of the CEM. The CEM describes the evaluation of the AVA_VAN components, up to AVA_VAN.5 CEM v3.1 R5, § 16.2.5 Evaluation of sub-activity (AVA_VAN.5).
• The components to be evaluated are those of Part 3 of the Common Criteria of the same version CC v3.1 R5 Part 3.
• A transition governed by the CCRA. According to the CCRA transition policy, revision 5 could be used for evaluations started no later than 30 June 2024, subject to the other rules of that policy CCMC-2023-04-001, _Introduction_ ~~es~~.

Links

• Common Criteria 3.1 revision 5, Parts 1 to 3 CC v3.1 R5 Part 1 CC v3.1 R5 Part 2 CC v3.1 R5 Part 3; current version CEM:2022 CEM:2022 R1.
• CCRA transition policy CCMC-2023-04-001; ISO/IEC 15408 and 18045 sheet ISO/IEC 15408 (1-5) and ISO/IEC 18045.
• Learning path: step 5, certification and standards.

Written by Asphalia.