From development to certification
Provide recognised proof of security
Manufacturers of security-critical IT products need to demonstrate the security of their products to customers, authorities and procurement organisations in a transparent and verifiable manner. The Common Criteria provide an internationally recognised evaluation framework that can be applied to a wide range of hardware, software and technology components.
Building on this foundation, the European Cybersecurity Certification Scheme on Common Criteria, or EUCC, provides a common European certification framework. It creates consistent conditions for evaluation and certification across the European Union. Due to its generic approach, EUCC is particularly well suited as a basis for evaluating the security of future technologies and, consequently, as a foundation for future regulatory requirements.
EUCC is therefore particularly relevant for international manufacturers looking to place their products on the European market and address requirements for recognised proof of security at an early stage. Depending on the technology and area of application, different Protection Profiles as well as technology- and product-specific requirements need to be considered within Common Criteria and EUCC.
achelos provides manufacturers with comprehensive support on the path to Common Criteria and EUCC certification – from initial assessment and certification strategy through development, integrated evidence management and testing to support during the evaluation.
As an independent cybersecurity company, we combine evaluation and certification expertise with many years of experience in product development and testing, and coordinate collaboration with evaluation and certification bodies. The independent evaluation and issuance of the certificate are carried out by the respective responsible bodies.
Leverage synergies between schemes
Many cybersecurity certifications and evaluation methodologies draw on principles, methods or security evidence from the Common Criteria ecosystem. At the same time, other international, European and national requirements call for their own security evidence, some of which overlaps. This creates opportunities to leverage synergies across different certification objectives and reuse evidence and results that have already been produced.
These links to Common Criteria can be found both in CC-related schemes and in other international, European and national requirements:
- CC-based and CC-related schemes, programmes and technologies
EUCC, SESIP, PSA Certified (ARM PSA), GlobalPlatform TEE, EMVCo, MIFARE, FeliCa
- Further international and European requirements with overlapping security evidence
CRA, EUDI Wallet, FiT CEM, ISO/SAE 21434, IEC 62443
- National evaluation and approval schemes
BSI-BSZ, CSPN, LINCE, BSPA, classified information approvals
As a European consultancy partner, achelos supports manufacturers across a broad range of national, EU-wide and international cybersecurity certifications – through a single partner and with the aim of making the best possible use of synergies between standards and schemes.
European partner network for international certification projects
achelos has established working relationships with evaluation laboratories and certification bodies in several European countries. This gives international manufacturers in particular greater flexibility when it comes to target markets, project requirements and available capacity.
In addition, achelos is active in the EUCC ISAC and participates in both the International Security Certification Initiative (ISCI) and the Software Technical Group. This keeps us closely involved in European standardisation activities relating to Common Criteria and EUCC.
End-to-end support throughout the certification process
We support manufacturers throughout all phases of a Common Criteria or EUCC project – whether for complete certification projects or clearly defined individual work packages.
Our approach is aligned with the relevant evaluation standards, Protection Profiles and technical domains, and we coordinate technical activities with evaluation laboratories and certification bodies.
Certification strategy and initial assessment
At the outset, we analyse the product, its security requirements and the intended certification objective. Particular attention is given to the Security Target and the cryptographic mechanisms used.
Based on this analysis, we provide a sound basis for decisions on how to proceed:
- Feasibility studies and effort estimates
- Security requirements specifications and scope definitions
- Selection of the appropriate evaluation approach
- Scheduling and definition of the required work packages
We also advise on the application process, support the selection and commissioning of a suitable evaluation laboratory, and prepare the required application forms and accompanying documents.
Product development and certification readiness
The foundations for a successful evaluation are established during product development. We therefore integrate the methodological requirements of Common Criteria and EUCC into technical decision-making at an early stage of the development process.
Our support ranges from security requirements engineering and security architecture scoping, assessment and hardening through to architecture, design and implementation – either in a supporting role or with full responsibility. We support product development for different assurance requirements. Within the Common Criteria context, our experience ranges from EAL 1 to EAL 7.
Development work can be carried out in CC-compliant facilities at the achelos development site in Paderborn. This allows the product, security architecture, tests and evidence to be developed as a consistent whole, providing a robust foundation for the certification process.
Test management and evaluation preparation
We advise and support manufacturers in planning and implementing tests for Common Criteria and EUCC evaluations. This includes preparing test specifications and, where required, implementing and carrying out the tests.
Automated test runs, traceable logging and structured error analysis help create repeatable and reliable test results. We also develop customised test suites that enable the required tests to be executed automatically.
Site security and audits
Common Criteria and EUCC projects also place requirements on the security of the development and production sites involved.
achelos develops security concepts for development and production sites as well as hardware security concepts. We bring our own practical experience of development in CC-compliant facilities and at a Common Criteria-certified development site directly into customer projects.
We also prepare manufacturers thoroughly for site visits and audits by evaluation laboratories and certification bodies. Internal training sessions and simulated audits help the teams involved present processes, responsibilities and evidence in a structured manner.
achelos supports the manufacturer during the audit and subsequently assists with follow-up activities and the handling of results.
Integrated evidence management
achelos integrates the evidence required for Common Criteria and EUCC into the development process. Security requirements are systematically and traceably translated into security architecture, design and implementation and kept consistent throughout the project.
Wherever possible, we reuse existing development artefacts and evidence and supplement them specifically with the content required for the evaluation. In this way, evidence evolves in parallel with product development and remains closely aligned with the current state of implementation.
Our experience covers the relevant assurance classes:
- Security Target – ASE
- Development – ADV
- Functional tests – ATE
- Vulnerability analysis – AVA
- Guidance – AGD
- Processes, tools and site security – ALC
The focus is on end-to-end traceability from security requirements through architecture, design and implementation to testing and evaluation evidence.
Project management, technical coordination, training and workshops
achelos takes responsibility for project management and technical coordination between the product manufacturer, development, production, evaluation laboratory and certification body.
Our experts bring together the required work packages, coordinate technical issues and support the handling of questions and findings arising from the evaluation. This support is available for both complete projects and clearly defined individual work packages.
Through practical training sessions and workshops, we prepare project teams for Common Criteria and EUCC projects. Topics range from an introduction to standards and evaluation processes to evidence requirements, product development, testing and site visits.
Broad experience across diverse applications
achelos supports CC and EUCC projects across a wide range of technologies and domains – from embedded systems and cryptographic components to digital identities, energy, mobility, defence and applications involving classified information.
Our experience includes:
- Electronic identities and official documents
- Health cards, card terminals and connectors
- Smart meter gateways and energy infrastructures
- Digital tachographs and mobility applications
- Hardware security modules and cryptographic components
- eIDAS signature creation components
- Secure IT systems for public authorities and cryptographic communication systems
Common Criteria-certified development site
The achelos development site in Paderborn is Common Criteria-certified. Our customers benefit from proven processes and the option of having architecture, development and testing activities carried out in CC-compliant facilities.
Technical expertise, international reach
achelos combines extensive evaluation and certification expertise with technical experience in product development and testing. This creates end-to-end support in which methodological requirements and technical implementation are closely integrated.
You benefit from:
- Multi-scheme expertise across national, European and international certification schemes
- State-of-the-art security engineering with integrated evidence management
- International project experience and a Europe-wide certification network
- Proven collaboration with evaluators, evaluation laboratories and certification bodies, including the BSI
- Broad technology and domain expertise
- A CC-certified development site
This enables us to prepare manufacturers, products and project teams for demanding evaluation and certification projects.
Together, we define the right approach
Are you looking to prepare a product for a Common Criteria or EUCC evaluation, understand international or European certification requirements, or obtain targeted support for an ongoing project?
Together, we analyse the current status of your project, identify the relevant standards and work packages, and develop an approach tailored to your certification project.
Do you have any questions? Your contact in this area is:
