Compliance FrameworksInternational
Common Criteria (CC)
ISO/IEC 15408, security evaluation assurance: configuration management, integrity testing.
ISO/IEC 15408, security evaluation assurance: configuration management, integrity testing.
| Short name | CC/EAL |
| Region | International |
| Country or scope | International |
| Sector | General |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers CC/EAL
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 13 controls from Safeguard's control catalog for CC/EAL.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for CC/EAL and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
CC-ALC-CMS Configuration Management Scope | The configuration list must include the product itself and the parts that comprise it, so every software component of the target of evaluation must be enumerated (ISO/IEC 15408 / CC Part 3, ALC_CMS) | Scan |
CC-ALC-CMC Unique Product Reference | The target of evaluation and its configuration items must be labelled with unique references so the evaluated version is unambiguous (ISO/IEC 15408 / CC Part 3, ALC_CMC) | Scan |
CC-ALC-CMCID Configuration Item Identification Method | Configuration items must be identified by a defined method that guarantees uniqueness, satisfied by standard identifiers such as PURL or CPE per component (ISO/IEC 15408 / CC Part 3, ALC_CMC identification requirements) | Scan |
CC-ALC-DEL Delivery Integrity | Delivery procedures must maintain the integrity of the product between production and installation, evidenced by cryptographic hashes over delivered components (ISO/IEC 15408 / CC Part 3, ALC_DEL) | Scan |
CC-ADV-DOC Evaluation Evidence Identity | Evaluation evidence documents must be identifiable and versioned so evaluators can tie evidence to the evaluated configuration, met by SBOM document identity and timestamp (ISO/IEC 15408, evaluation evidence requirements) | Scan |
CC-AVA-VAN Vulnerability Analysis Precision | Vulnerability analysis of the evaluated product requires exact, non-vague component versions so public vulnerability information can be applied to the precise configuration (ISO/IEC 15408 / CC Part 3, AVA_VAN) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
ALC_CMC.1 | Configuration Management Capability Labelling |
ALC_CMC.4 | Production Support, Acceptance Procedures and Automation |
ALC_CMS.4 | Problem Tracking Configuration Management Scope |
ALC_DEL.1 | Delivery Procedures |
ALC_DVS.2 | Sufficiency of Security Measures for Development |
ALC_LCD.1 | Developer Defined Life-Cycle Model |
ALC_TAT.1 | Well-Defined Development Tools |
ATE_COV.2 | Analysis of Coverage |
ATE_DPT.2 | Testing Security Enforcing Modules |
ATE_FUN.1 | Functional Testing |
ATE_IND.2 | Independent Testing: Sample |
ASE_TSS.1 | TOE Summary Specification |
ADV_ARC.1 | Security Architecture Description |
Policy templates
Written for CC/EAL:
- TOE Development Lifecycle and Configuration Management Policy
- TOE Security Testing Policy
- TOE Delivery and Operational Guidance Policy
And 22 from the standard set, adapted to CC/EAL.