We prepare ICT product vendors for evaluation under the European Common Criteria-based scheme (EUCC) and help them keep their certificates valid afterwards. We work alongside your ITSEF and certification body: we do not evaluate and we do not certify.
For
You receive
EUCC is the European cybersecurity certification scheme based on the Common Criteria, adopted under the Cybersecurity Act by Implementing Regulation (EU) 2024/482 and applicable since 27 February 2025. It builds on the SOG-IS mutual recognition agreement and its supporting documents. National schemes covered by EUCC ceased to produce effects twelve months after the Regulation entered into force (Article 49). Certificates already issued under those schemes remain valid until they expire (Article 57(3) of the Cybersecurity Act) and can be reviewed and replaced by EUCC certificates. The evaluation standards are CC:2022 and CEM:2022 (ISO/IEC 15408 and ISO/IEC 18045); certificates applying CC and CEM version 3.1 revision 5 can be issued until 31 December 2027 (Article 3, as amended by Implementing Regulation (EU) 2024/3144).
EUCC certificates are issued at assurance level 'substantial', which corresponds to AVA_VAN 1 or 2, or 'high', which corresponds to AVA_VAN 3, 4 or 5 (Article 4). AVA_VAN 4 and 5 are only possible for products covered by the technical domains 'smart cards and similar devices' or 'hardware devices with security boxes', for products covered by a certified protection profile listed in Annex II that includes those levels, or, where neither applies, in exceptional cases approved by the national cybersecurity certification authority (Article 7(3)). For those two technical domains, Annex I lists the state-of-the-art documents that apply at AVA_VAN 4 and 5, among them the minimum site security requirements, the reuse of site audit results (STAR), the application of attack potential and, for smart cards, composite product evaluation. Self-assessment is not permitted (Article 6), and a certificate is valid for up to five years unless that authority approves a longer period (Article 12). The holder must monitor vulnerabilities, run vulnerability management procedures, analyse the impact of each potential vulnerability and report to the certification body when conformity is likely affected (Articles 27 and 33 to 36). Changes to the product go through an impact analysis report and are classified as minor or major (Annex IV).
The Cyber Resilience Act lists hardware devices with security boxes, smart meter gateways and other devices for advanced security purposes, and smartcards or similar devices including secure elements as critical products with digital elements (Annex IV). Implementing Regulation (EU) 2025/2392 includes in the first category hardware security modules and payment terminals that meet its description, and describes secure elements as designed to provide protection of at least AVA_VAN 4. Under Article 8(1), the Commission can require these products to hold a European cybersecurity certificate at assurance level at least 'substantial'; until it does, they follow the procedures of Article 32(3) (Article 32(4)(b)). Under Article 27(8), an EUCC certificate gives a presumption of conformity with the essential cybersecurity requirements it covers.
Review of your national certificates, security targets and evidence against EUCC: CC:2022 or CC 3.1 revision 5, the applicable state-of-the-art documents, the vulnerability management obligations and the choice between a certificate review and a new evaluation. You receive a product-by-product plan to discuss with your certification body.
Typical duration: 2 to 3 weeks
Drafting or rework of the security target: TOE description and boundaries, security problem definition, objectives, functional and assurance requirements, protection profile conformance claims and rationale. Includes the sanitised version for publication and the English version the certification body can request, since ENISA publishes the security target of each certificate.
Typical duration: 3 to 6 weeks
Life-cycle evidence (configuration management, delivery, development security, life-cycle definition, tools and techniques, flaw remediation) and guidance documents (preparative procedures and operational user guidance), written to the CEM work units your ITSEF will apply. For smart cards and hardware devices with security boxes, site security documentation (ALC_DVS) prepared against the 'Minimum Site Security Requirements', and the site audit results you can provide for reuse under STAR.
Typical duration: 4 to 8 weeks
An internal review of your evaluation evidence against the CEM work units before you hand it to the ITSEF, so that the lab raises fewer observations and the evaluation runs on schedule. The verdict remains the ITSEF's and the certification body's.
Typical duration: 2 to 4 weeks
Vulnerability management and disclosure procedures that meet Chapter VI of the EUCC Regulation, a vulnerability impact analysis template with attack potential calculation, using the attack potential documents for smart cards or hardware devices with security boxes where they apply (Article 34(2)), a patch management procedure that can be assessed under Annex IV, and the supplementary cybersecurity information required by Article 55 of the Cybersecurity Act. Javier Tallón, our founder, co-edited ISO/IEC TS 9569:2023, the patch management extension for ISO/IEC 15408 and ISO/IEC 18045.
Typical duration: 3 to 5 weeks
Impact analysis reports for product changes with the argument for minor or major classification, evidence for adding ALC_FLR flaw remediation to a certified product, which the certification body can confirm through a partial evaluation (Annex IV), preparation for re-assessment and re-evaluation, and a renewal plan. The holder can request a review when the certificate is due to expire within nine months.
Typical duration: 1 to 2 weeks per change
Yes, until it expires. Certificates issued under national schemes remain valid until their expiry date (Article 57(3) of the Cybersecurity Act), although the national schemes covered by EUCC no longer produce effects (Article 49(1) of Implementing Regulation (EU) 2024/482). To keep the product certified, the certificate can be reviewed and replaced by an EUCC certificate (Article 49(3)). Where that review takes place within two years of the initial certificate, CC and CEM 3.1 revision 5 may still be applied (Article 49(4)), and the ITSEF can reuse earlier evaluation results that still meet the requirements (Article 8(3) and (4)).
A patch management procedure is optional, but it has to be assessed during certification to be used afterwards (Annex IV, section IV.4). It can cover patches to functionality outside the TOE, predetermined minor changes, and fixes for confirmed vulnerabilities with critical effects. Within five working days of applying such a patch, the holder reports it to the certification body or submits it to the ITSEF, depending on the case. Changes outside that procedure need an impact analysis report and are handled as minor changes (maintenance report) or major changes (re-evaluation).
Monitor vulnerability information about the product and its known dependencies (Article 27), publish a way to receive reports and record every potential vulnerability (Article 33), analyse its impact with an attack potential calculation where applicable (Article 34), and send a vulnerability impact analysis report to the certification body without undue delay when conformity is likely affected (Article 35). A remediable vulnerability leads to a remediation proposal and a certificate review (Article 36). A vulnerability that is not residual and cannot be remedied leads to withdrawal (Article 35(6)).
'Substantial' covers AVA_VAN 1 and 2; 'high' covers AVA_VAN 3, 4 and 5 (Article 4). AVA_VAN 4 and 5 require the state-of-the-art documents of the technical domains 'smart cards and similar devices' or 'hardware devices with security boxes', a protection profile listed in Annex II, or a case-by-case approval by the national cybersecurity certification authority (Article 7(3)).
Yes. Annex IV of the Cyber Resilience Act lists smartcards or similar devices, including secure elements, together with hardware devices with security boxes and smart meter gateways. The Commission can require them to hold a European cybersecurity certificate at assurance level at least 'substantial' (Article 8(1)); without that delegated act they follow the procedures of Article 32(3) (Article 32(4)(b)). An EUCC certificate gives a presumption of conformity with the essential requirements it covers (Article 27(8)).
As a composite product: one evaluated together with an underlying product that already holds an EUCC certificate and on whose security functionality it depends (Article 2). Where the certification body allows composite certification, the applicant makes the necessary elements available to the certification body and the ITSEF in accordance with the state-of-the-art document (Article 8(5)), and the ITSEF and certification body of the underlying product share the relevant information with those of the composite product (Articles 7(5) and 9(3)). Annex I lists the composite product documents of the smart card domain for CC 3.1 and for CC:2022. When a potential vulnerability impacts a composite product, the certificate holder informs the holders of dependent EUCC certificates (Article 33(4)). We prepare the application's security target and evidence so that they are consistent with the platform's security target and guidance.
No. We are not a testing laboratory, a certification body or a notified body, and we do not issue certificates. The ITSEF evaluates and the certification body certifies. We prepare the security target and the evidence, review them before submission and support you through observations and maintenance. We are a boutique consultancy working in English and Spanish, and we work regularly with certification authorities and experts from across Europe, including ANSSI and BSI, in ENISA, ISO and ETSI working groups.