I already have my Common Criteria certified product, now what?

First of all, congratulations if you have obtained your Common Criteria certification, it is a great challenge!

As an accredited laboratory and expert consultants in Common Criteria, one of the main concerns of our customers and, to our understanding, of manufacturers in general, is to maintain always the latest version of the product (TOE) in the "Certified Products List" of the official Common Criteria portal.

At jtsec we are aware that manufacturers and developers modify, improve and evolve their products continuously, so we understand your concerns in this regard. Certifying a product under the Common Criteria standard is not easy, it can be costly both financially and in terms of time.

In order to shed some light on this issue, we will explain the most common doubts regarding the maintenance of a product within the "Certified Products" catalogue.

How long does my product remain on the "List of Certified Products"?

The product remains in the "List of Certified Products" for 5 years, as long as there is no vulnerability that affects the certified version and therefore entails the revocation of the certificate. Once this time has elapsed since the certificate was issued, the product goes to the "Archived Certified Products List" , unless the validation time is extended using the appropriate procedures for this purpose.

Procedure to extend the validation time of my product or to maintain it in case it has undergone modifications

There is a procedure called "Assurance Continuity" developed to allow manufacturers to keep their product certified to the latest version.

The process to be followed by the manufacturer has the following steps:

If the changes are minor, a Maintenance Report will be created and if they are major, a new certificate will be issued. Original source: https://www.commoncriteriaportal.org/files/operatingprocedures/2012-06-01.pdf

What do "major" and "minor" changes in the TOE mean?

The Certification Body, based on the Common Criteria Recognition Arrangement (CCRA), qualifies the changes, which can be of two types depending on how they affect the consistency of the product security:

"Minor" changes: Considered to be those that do NOT directly affect the security of the product, and therefore do not require a re-evaluation but a maintenance process. Some of these changes may be, for example, editorial changes. It should be noted that the Certification Body will ultimately consider whether the changes are "major" or "minor" and therefore require a re-evaluation or not.

How can jtsec help you to keep your product on the "List of Certified Products"?

At jtsec we have extensive experience in Common Criteria, always providing an approach aimed at saving our clients the maximum amount of time and money, facilitating the processes and adjusting to their needs.

In all our projects, we include certificate maintenance management at no cost to our clients. Shall we talk?