CC Assurance Continuity

The awarding of a Common Criteria (CC) evaluation certificate indicates to the user community that the CC evaluation authority is convinced that all necessary evaluation work has been performed, that the product meets all the defined assurance requirements that are required for the particular Evaluation Assurance Level (EAL) and functionality being claimed, and that the product meets its security objectives.


CC certification is directly tied to a specific version and configuration of a product as identified in the awarded Certificate, Certification Report and Security Target (see the list of evaluated products for examples).  Certification does not automatically extend to new versions of the product as changes are made to either introduce new features or capabilities or address known issues.


In order to address the types of changes that are always a part of the life cycle of Information Technology (IT) and IT Security products, the Common Criteria utilizes the concept of assurance continuity, whereby certification may be extended to include updated versions of products as they evolve.  CC Assurance Continuity recognizes that, as changes are made to a certified Target of Evaluation (TOE) or its environment, evaluation work previously performed need not be repeated in all circumstances.  Assurance Continuity, therefore, defines an approach to minimizing redundancy in IT security evaluation, allowing a determination to be made as to whether independent evaluator actions need to be re-performed.


EWA-Canada can help determine if the set of changes and updates made to the product qualify for extending certification under Assurance Continuity.  EWA-Canada can also help put together the package of information, including the Impact Assessment Report (IAR) and regression testing, needed by the Certification Body to determine that Assurance Continuity applies and that certification may be extended to the updated version of the product and/or TOE.

EWA-Canada can help with your certification needs.

Please Contact Us for further information.