Common Criteria EAL levels explained: EAL1 to EAL7, augmentations and protection profiles

Common Criteria for Information Technology Security Evaluation (ISO/IEC 15408) is the international standard for evaluating the security of IT products. A vendor writes a security target that states what the product protects and how. An accredited lab evaluates the product against it, and a national certification body issues the certificate. The Evaluation Assurance Level (EAL) says how much evidence and testing that evaluation required.

The seven Evaluation Assurance Levels

• EAL1, functionally tested: the product works as documented. Used when some confidence is needed but threats are not serious.
• EAL2, structurally tested: adds design information and vulnerability analysis against basic attackers.
• EAL3, methodically tested and checked: adds development environment controls and more thorough testing.
• EAL4, methodically designed, tested and reviewed: the highest level usually reachable for an existing commercial product without major redevelopment. Common for operating systems, firewalls and databases.
• EAL5, semiformally designed and tested: adds a semiformal design and stronger vulnerability analysis. Common for smart cards and secure elements.
• EAL6, semiformally verified design and tested: for high-risk environments where the value of the assets justifies the cost.
• EAL7, formally verified design and tested: formal methods and extensive testing, for very high-risk situations. Rare in practice.

What the "+" means

A certificate such as EAL4+ or EAL6+ is augmented: it meets the base level plus extra assurance components. Two augmentations come up often. ALC_FLR adds flaw remediation, meaning the vendor has a process to track and fix security flaws after certification. AVA_VAN.5 raises the vulnerability analysis to attackers with high attack potential, which is what smart card and secure element evaluations usually target. Always read which components were added, because "+" alone does not say.

Protection profiles and schemes

• Protection profiles set the security requirements for a product type, such as smart cards, network devices or full disk encryption. A product that claims conformance must meet them.
• Collaborative protection profiles (cPPs) are written by international technical communities and are often evaluated without an EAL, as exact conformance to the profile.
• National schemes such as BSI (Germany), ANSSI (France), NLNCSA (Netherlands), NIAP (US) and others issue certificates. The Common Criteria Recognition Arrangement lets member countries recognise each other's certificates up to an agreed level, and EU schemes recognise higher levels between their members.
• Certificates are listed on the Common Criteria Portal as active or archived, with the certification report and security target.

Questions to try

• "List active Common Criteria certificates at EAL6 or above for smart cards."
• "What augmentations does certificate BSI-DSZ-CC-1091-2018 include?"
• "Which network devices are certified against a protection profile, and by which scheme?"
• "Compare the EALs of the Common Criteria certificates held by these two vendors."

Certificate data comes from sec-certs.org, built by the Centre for Research on Cryptography and Security (CRoCS) at Masaryk University from NIST CMVP and the Common Criteria Portal. KBrain refreshes it weekly and links it to the CVE brain.