Compliance with the Common Criteria detailed in ISO/IEC 15048-1 consists of two quality assurance aspects:
- Assessment of Security Assurance Requirements (SARs) — This is a review of the processes undertaken during the development and evaluation of a given IT product to assess compliance with the prescribed security functionality, which may vary depending on their intended use and anticipated risk environment.
- Evaluation Assurance Level (EAL) — This assesses the difficulty of the evaluation process itself, and can range from the most basic level of cyber security (EAL 1) through the most rigorous process to verify the claimed level of security (EAL 7).
*It is important to note that an EAL is only an assessment of the rigour of the evaluation process itself: ITE with a higher EAL does not necessarily indicate a more secure device.
How Nemko Can Help
Nemko can provide comprehensive guidance according to the Common Criteria requirements detailed in ISO/IEC 15408-1.
- Protection Profile Assessment— Procurement organizations may require third-party vendors to offer evidence that their product has been designed to conform to the requirements of one or more protection profiles (PP). Nemko experts can work with you to assess your equipment's compliance with relevant PPs and provide attestation to support your claims.
- EAL/Security Target (ST) Assessment—The PP assessment can serve as a basis for defining the required security properties, so Nemko experts can conduct an evaluation of your equipment consistent with both the required STs and the requisite EAL.
- Nemko can also conduct a preliminary functional gap assessment (FGA) ahead of more formal security analyses to help identify potential issues and can help to ensure that these devices meet essential Common Criteria requirements ahead of time.
Benefits of Working with Nemko
Partnering with Nemko can provide your organization in addressing the challenges that occur in today's cyber security landscape.
Recognized Cyber Security Expertise
Acquired by Nemko in 2020, Systemsikkerhet is Norway's first information security consultancy and is one of only four information security testing laboratories recognized by the Norwegian National Security Authority.
Active Involvement in Standards Development and Implementation
Nemko’s team of experts have developed state-of-the-art cyber security standards and protocols, and are knowledgeable about all new, emerging requirements.
Single Source Solution
With its combined expertise in cyber security, product safety, Radio/Telecom and electromagnetic compatibility (EMC), Nemko is a robust source for manufacturers.