Certifying a product under the Common Criteria methodology is not easy, there are several variables, mainly at the beginning of the project, which are key to the proper development of the evaluation.
One of the important decisions to be made is to verify whether the product adapts to the characteristics and requirements of an existing Protection Profile (PP) or not.
But, what is a Protection Profile (PP)?
A Protection Profile (PP) is a document that can be used as part of the process of certifying a product according to the Common Criteria standard (ISO/IEC 15408.). It is developed by a user or community of users, creating a generic Security Target (ST) for the technology concerned. Every Protection Profile includes security activities with the objective of achieving feasible, repeatable and verifiable evaluations within each category.
How to evaluate a product that FITS a Protection Profile?
There are currently 223 PPs divided into en 14 categories according to the official Common Criteria website. These PPs are adjusting to the market as the number of products developed by manufacturers increases and, due to the continuous development of new technologies, new certification PPs are demanded that are not developed.
If your product is within the parameters of a specific PP, the process of certification of your product is speeded up by having it already:
How to evaluate a product that DOES NOT FIT a Protection Profile?
The development of PPs arises mostly from the demand of the market itself from the type of solutions that the market demands to certify under the Common Criteria standard. However, it may be that a product with a new technology on the market needs to be certified, or that this type of solution has simply never been certified under the Common Criteria methodology.
If this case arises, the cybersecurity consultant and the company that developed the product are the pioneers in creating the specific Security Target (ST) for that category so it takes more work and time. It is possible that in the future the Security Target will be adopted as part of a Protection Profile for this type of product.
.
