NP002 - EUCC processes v2.0

• Collect information about possible evaluation/certification leads
  • Request information on possible evaluation/certification leads for assurance-level high from internal account management or sales department.
  • Request information on possible evaluation/certification leads for assurance-level high from associated external ITSEFs (when applicable).

Note 1: This information has to be collected on a monthly basis. If the CAB makes use of external ITSEFs, then it may request this information every month from the ITSEFs, or procedurally demand from the ITSEF that they send this information structurally every month to them.

Note 2: A CAB is expected to report to the NCCA on a monthly basis all evaluation/certification leads for assurance-level high of which it expects with more than 70% certainty that they will lead to a notification within the next three months.

• Compile monthly forecast
  • Download the monthly forecasting template from NCCA website.
  • Fill in the required fields using the collected information.

Note: In the case a sponsor approached multiple CABs/ITSEFs to perform an evaluation on their product, add all these requests to the forecasting template.

• Submit monthly forecast to the NCCA
  • Send the monthly forecast to the NCCA on the first working day of the month.

Note 1: It is understood that the information is commercially sensitive. NCCA will only use this information for its resource planning.

Note 2: The monthly forecast may be submitted encrypted or unencrypted. If the CAB wishes to submit the monthly forecast encrypted it may do so with PGP encryption using the public NCCA keys, which can be downloaded from the NCCA website.

• Receive the monthly forecast
  • Receive (and decrypt if required) the monthly forecast from every CAB.
  • Archive and register the monthly forecasts in the NCCA document management system.

• Check the monthly forecasts for completeness
  • Check that all necessary information is contained in the monthly forecasts.
  • Notify a CAB in the case their monthly forecast is incomplete and request missing information.

• Send confirmation
  • Send a message to the CABs that their monthly forecasts are well received.

• Combine monthly forecasts
  • Transfer every entry from the monthly forecasts to the central NCCA forecast overview, while keeping the references to the CABs and ITSEFs.
  • Highlight the changes compared to the forecast from previous month.

• Determine monitoring type
  • Based on the following factors, determine whether there is a need for certification monitoring:
    • The importance-level of the product for the public or Dutch government (e.g. Netherlands passport).
    • If the product is of specific interest for RDI (Relations with areas of interest and research).
    • The level of experience of the CAB (including the ITSEF) with the type of product.
    • The level of experience of the sponsor/developer with the Common Criteria standard.
    • The past performance of the CAB (including the ITSEF).
    • The assessment type (new, re-certification, maintenance).
    • The expected duration of the evaluation/certification.
  • Include in the forecast overview if monitoring will be foreseen.

• Pre-allocate resources
  • For every potential project pre-allocate a certification auditor based on availability and specific knowledge related to the type of product or previous experience with the product that will be evaluated.
  • Include the name of the pre-allocated certification auditor in the forecast overview.

Note 1: The pre-allocated certification auditor must be independent from, and not be involved in, the activities of the sponsor/developer and the CAB.

Note 2: There may be a need for additional expertise from outside the NCCA. This could be because the relevant expertise is not present within the NCCA, there are insufficient resources available or for other reasons. In such cases the certification auditor could be assisted by an external expert.

• Determine object to be certified
  • The EUCC can only be used to certify products or protection profiles. If a sponsor wants to certify a process or service under the Cyber Security Act, determine which other EU scheme is relevant.

• Determine assurance level
  • Determine the assurance level that is required for the evaluation based on the threat-level that the product needs to counter, intended use, marketing needs, etc.

• Determine which CAB’s are accredited to perform the EUCC certification activities³
  • Determine which CAB’s are accredited to perform certification activities at the required assurance-level, and where relevant the technical domain. A list of CAB’s is available on the NCCA website.
  • Determine, based on own needs, requirements and preferences, which of the CAB’s is preferred to perform the EUCC certification activities.

• Create a (draft) Security Target (ST) / Protection Profile (PP)
  • Create an initial version of the ST or PP that describes the TOE in sufficient details such that the logical and physical boundary is clearly defined. Also the Security Problem Definition and Objectives must be complete.

Note: drafting a ST or PP is a specialised task for which the sponsor may want to contract/hire a CC consultant or expert. This may be an independent consultant, but the envisaged CAB could also provide this consultancy service. However the CSA and EUCC impose restrictions on consulting services.

• Consult envisaged CAB and reach an certification agreement
  • (Optionally) Submit the (draft) ST/PP to the envisaged CAB.
  • Consult the envisaged CAB to determine to what extend the CAB is able and willing to perform the certification activities based on the (draft) ST/PP and under which conditions.
  • Come to a contractual agreement with the CAB for performing the certification activities.

Note: If the CAB makes use of external ITSEFs, then the sponsor may also need to come to a contractual agreement with the ITSEF for performing the evaluation part of the certification activities.

• Draft an EUCC notification form
  • Receive the (draft) ST/PP (if not already in possession).
  • Check that the (draft) ST/PP describes the TOE in sufficient details so that the logical and physical boundary is clearly defined. Also check the completeness of the Security Problem Definition and Objectives.
  • Download the NCCA template NT003 - EUCC notification form from the NCCA website.
  • Fill in the required fields.

• Draft assessment plan
  • Draft an assessment plan describing the evaluation and certification activities based on the draft ST/PP and NCCA procedures. The assessment plan must address the following five items in clearly separated sections:
    • Appropriateness: Is the chosen assurance level appropriate and is the chosen level commensurate with the level of risk associated with the intended use of the ICT product?
    • Evaluation and certification approach: the CAB shall describe which entity will perform the evaluation activities in case of outsourcing. Also some background information regarding the product to be evaluated shall be provided. The evaluation and certification approach shall be based on the default set of ERMs (see introduction of chapter 3.2 and the NCCA instruction NI002 - Content and presentation of evaluation review meetings) where the content is tailored in accordance with the EAL. If the CAB wants to deviate from this default set or content, the deviation must be described and motivated. This also applies in case the CAB wants to use the alternative approach for ADV and ATE. When previous evaluation results (e.g. ETR for composite evaluations, STAR reports or otherwise) will be re-used this must be indicated and described how;
    • Applicable standard and additional evaluation methodology: The CAB shall identify the version and revision of the ISO/IEC 15408 or the CC and which additional evaluation methodology, besides ISO/IEC 18045 or the CEM, will be used. This additional evaluation methodology shall be in accordance with the EUCC scheme requirements, the product type, technical domain and State-of-the-Art documents;
    • Staff involved in consultancy, evaluation and certification: in this section, the CAB must identify the key-staff involved in the evaluation and certification activities, especially the persons that authorise the deliverables. The CAB must also identify and describe any consultancy services that have been provided to the sponsor and list the staff involved. This is of particular importance when the consultancy has involved writing documentation on behalf of the sponsor or in any (pre-) evaluation activities. Staff involved in consultancy may not perform evaluation or certification activities or mentor other employees during these activities;
    • Evaluation and certification schedule: this is the schedule for the delivery of all required evaluator evidence and the Evaluation Technical Report by the evaluators and the review thereof by the certifiers, including the ERMs. Also the planned date for the delivery of the Certification Report and the (draft) Certificate to the NCCA for approval must be indicated.

Note 1: The EUCC (in recital 3 and 5) requires the sponsor to provide a rationale for selecting the correct assurance level which the CAB shall review. This review must be included under the ‘appropriateness’ section in the assessment plan.

Note 2: While scheduling the ERMs, consideration must be given that the ERMs cannot be held without the NCCA approval for the suggested ERM dates in the assessment plan. In practice the first ERM should not be planned soon after the notification has been submitted as this increases the risk that the ERM will have to be rescheduled due to NCCA resource management and preparation. In general a 15 working days delay is needed after the formal approval has been issued by the NCCA (see Action 1.3.4: Issue formal decision on assessment plan).

• Submit EUCC notification to sponsor
  • Send the EUCC notification form and assessment plan to the sponsor for verification and approval.

• Receive the EUCC notification
  • Receive the EUCC notification form and assessment plan.
  • Check the EUCC notification form for correctness, and fill in the remaining open fields.

• Approve EUCC notification form
  • Return the completed EUCC notification form and assessment plan to the CAB with a statement of approval.

• Receive the EUCC notification
  • Receive the EUCC notification form and assessment plan.

• Submit the EUCC notification
  • Gather the (draft) ST/PP (already in possession of the CAB).
  • Sign the EUCC notification form, if not already done. 
  • Compose the EUCC notification:              
    • EUCC notification form;
    • Assessment plan;
    • (draft) ST/PP.  
  • Send the notification to the NCCA.

Note 1: The EUCC notification form and related documents may be submitted encrypted or unencrypted. If the CAB wishes to submit the documents encrypted it may do so with PGP encryption using the public NCCA keys, which can be downloaded from the NCCA website.

• Receive the notification
  • Receive (and decrypt if required) the EUCC notification form, the assessment plan and the (draft) ST/PP.
  • Confirm the reception of the notification to the CAB.
  • Archive and register the notification in the NCCA document management system and create an audit file.
  • Check if the notification is on the forecast overview. If present, copy the certification information from the forecast overview to the audit file and update the forecast overview.

• Determine monitoring type
  • Based on the following factors, verify if the envisioned monitoring decision from the forecast overview is still appropriate, or determine whether certification monitoring is needed:
    • The importance-level of the product for the public or the Dutch government (e.g. Netherlands passport).
    • If the product is of specific interest for RDI (Relations with areas of interest and research).
    • The level of experience of staff involved from the CAB (including the ITSEF) with the type of product.
    • The level of experience of the sponsor/developer with the Common Criteria standard.
    • The past performance of the CAB (including the ITSEF).
    • The assessment type (new, re-certification, maintenance).
    • The expected duration of the evaluation/certification.
  • Include or update if monitoring is foreseen in the audit file.

• Appoint Certification Auditor
  • Verify if the envisioned certification auditor is still available. If not, select a certification auditor based on availability and specific knowledge related to the type of product or previous experience with the product that will be evaluated.
  • Inform the certification auditor that he/she is appointed to the certification process and if monitoring is foreseen.
  • Include or update the name of the certification auditor in the audit file.

Note 1: The appointed certification auditor must be independent from, and not be involved in, the activities of the sponsor/developer and the CAB.

Note 2: There may be a need for additional expertise from outside the NCCA. This could be because the relevant expertise is not present within the NCCA, there are insufficient resources available or for other reasons. In such cases the certification auditor could be assisted by external expert(s).

• Create Notification Review Report
  • Create a Notification Review Report to document any discussions and comments related to the notification.

Note: The Notification Review Report is intended to collect findings on the notification documents, and forms the basis for the formal decision on the assessment plan.

• Check the EUCC notification for completeness
  • Perform a high level check on the following items as a minimum:
    • Does the notification include a complete assessment plan and (draft) ST/PP?
    • Are all required fields in the notification form filled in?
    • Is the notification form signed by the CAB?
  • Notify CAB in case the application is incomplete and request missing information.
  • Update the Notification Review Report with findings.

• Check the EUCC notification for correctness
  • Perform a high level check on the following items:
    • Scope of the CAB: Does the TOE fall within the accreditation scope of the CAB?
    • Authorisation of the CAB: Is the CAB authorised by the NCCA?
    • Authorisation of the ITSEF: Is the evaluation task performed by an authorised ITSEF?
  • Update the Notification Review Report with findings.
  • Continue with Action 1.3.4: Issue formal decision on assessment plan in case the application is incorrect or remains incomplete. This will lead to a rejection of the application and the termination of the certification process. Otherwise continue with Action 1.3.3: Review assessment plan and (draft) ST/PP.

Note: The checks on scope and authorisation will not take part in case the EUCC notification is part of an initial assessment that the CAB needs to perform as part of its initial accreditation and licensing process.

• Review assessment plan
  • Perform a detailed review of the assessment plan based on the Notification review guidance. Focus areas are:
    • Appropriateness: Is the chosen assurance level appropriate and is the chosen level commensurate with the level of risk associated with the intended use of the ICT product and does the CAB review confirms this?
    • Evaluation & certification approach: Does it describe which entity will perform the evaluation activities in case of outsourcing and does it provide sufficient background information regarding the product to be evaluated? Is the approach correctly based on the default set of ERMs (see introduction of chapter 3.2 and NCCA instruction NI002 - Content and presentation of evaluation review meetings) and are deviations and choices well motivated? Check if re-use of previous results is possible as described, i.e. check the validity of evaluation results in case of re-use for composite evaluations, site audit results and maintenance activities.
    • Applicable standard and additional evaluation methods: Are the standard and additional evaluation methods correctly identified and do they include all applicable methodology as required by the EUCC scheme?
    • Staff involved: Is key-staff identified? Are there any issues related to independence and competence expected?
    • Project planning: Do the dates of planned ERMs and the delivery of the final evaluation & certification reports (i.e. the request for approval) allow for reasonable time to address open issues.
  • Discuss any items that are unclear with the CAB to gain necessary clarification in order to finalise the review.
  • Update the Notification Review Report with findings.

Note: The EUCC (in recital 5) requires the sponsor to provide a rationale for selecting the correct assurance level which the CAB shall review. This review must be included under the ‘appropriateness’ section in the assessment plan.

• Review (draft) ST/PP
  • Perform a detailed review of the (draft) ST/PP based on the Notification review guidance:
    • Clarity: Is the ST or PP clear and understandable, is the TOE scope with its logical and physical boundaries well defined?
    • Meaningfulness: Does the ST or PP comprise sufficient functionality to come to a meaningful certificate and does the security problem definition not contain any assumptions that unreasonably limit the usability expected by the end-user?
    • Assurance requirements: Check the assurance requirements contain the appropriate AVA_VAN and ADV_IND components and its dependencies. Also check if the appropriate ALC_FLR component is included to address the sponsor requirements described in EUCC Chapter V and VI.
  • Discuss any items that are unclear with the CAB to gain necessary clarification in order to finalise the review.
  • Update and finalise the Notification Review Report with findings.

Note: The EUCC (in article 7) requires security assurance requirements classes for vulnerability assessment and independent functional testing to be included in the evaluation. The EUCC in Chapter V and VI also has requirements related to vulnerability monitoring, management and disclosure for which the sponsor shall establish and maintain the necessary procedures. In the Netherlands these procedures need to be included in the evaluation.

• Validation of the Notification Review Report
  • Check if the Notification Review Report is complete, correct and consistent.
  • Sign off the Notification Review Report.

• Draft a formal acceptance or rejection letter
  • Fill-in the applicable NCCA letter template.
  • Have the letter signed.

Note: The letter of acceptance will include the name of the certification auditor and where applicable the name of the external expert(s). Also if monitoring will be performed is indicated.

• Submit the formal decision letter (acceptance or rejection) to the CAB
  • Send the letter to the CAB.

Note: The formal acceptance is based on the content of the provided assessment plan. This plan may need to change at a later stage and then requires a renewed acceptance by the NCCA. Changes of the assessment plan or deviations thereof may have consequences for the NCCA approval to issue a certificate. See also Step 2.5: Project monitoring.

• Define necessary developer evidence
  • The content to be discussed in each ERM is specified in the assessment plan and will dictate what developer evidence is to be provided by the sponsor. This developer evidence is related to the relevant developer action elements from the chosen assurance package and associated security assurance requirements from the Common Criteria standard (ISO/IEC 15408) and all other necessary information that is required by the EUCC scheme. These will form the input for the evaluation activities that are to be performed by the evaluator in preparation for the ERM.

• Submit request for the needed developer evidence
  • Send the request to the sponsor to provide the necessary developer evidence.

• Receive evidence from sponsor
  • Record evidence received in accordance with the applicable evaluation procedures.

• Evaluate evidence
  • Perform evaluation activities for the applicable ERM (as defined in the assessment plan) in accordance with the evaluation methodology specified in the CEM and any associated methodology specified in the assessment plan.
  • Record findings and verdicts in the evaluator evidence as defined for the relevant ERM.
  • Address actions from the project actions list (e.g. items raised in previous ERMs), providing a disposition of how the action has been addressed.

• Finalise the evaluator evidence
  • Check that the evaluator evidence contain the necessary information.

• Verify all evaluator evidence
  • Approve and authorize all evaluator evidence before submitting for formal CAB review.

• Submit all evaluator evidence
  • Send the evaluator evidence and updated project action list to the CAB/certifier for formal review.

• Receive completed package of evaluator evidence from the CAB/evaluator.
  • Check the package is complete in accordance with the list of deliverables specified in the assessment plan.

• Review evaluator evidence.
  • Review the evaluator findings and conclusions reported in the evaluator evidence and record any comments/notes for discussion in a Certifier Review Report.
  • Review disposition of action items and updates made to evaluator evidence to address actions (if any) from the project actions list.

• Preparation of Evaluation Review Meeting
  • Once the certifier is confident that the evaluation activities relevant for the ERM have been completed successfully, the ERM data/time/location can be confirmed by the certifier.
  • The CAB organises a meeting at a mutually agreed location. The sponsor/developer is encouraged, but not required, to attend the meeting. The NCCA endeavours to attend most meetings. Other parties are only allowed to attend if sponsor and CAB agree.
  • Send the complete package of evaluator evidence including the project actions list and Certifier Review Report to the NCCA & optionally to the sponsor.
  • Confirm and invite the NCCA and optionally the sponsor to the ERM.

Note 1: The meeting deliverables are to be sent to the NCCA/certification auditor at least 5 working days before the meeting is scheduled to be held.

Note 2: The meeting deliverables and invitation are optionally sent to the sponsor depending on the agreement between the CAB and sponsor.

Note 3: The ERMs shall be held as a physical only meeting on a location in the Netherlands.

• Create developer evidence
  • Collect all necessary information that is relevant for the chosen assurance level and associated security assurance requirements as defined by the Common Criteria standard (ISO/IEC 15408) and requested by the CAB.
  • Collect all other necessary information that is required by the EUCC scheme.

• Compile and provide developer evidence to the CAB
  • Supply the developer evidence to the CAB for evaluation.

Note: Developer evidence can take many forms, including documents, e-mails or physical access to the development site. The form in which the developer evidence is supplied to the CAB needs to be mutually agreed. The CAB may for example agree to get access to the information on the premises of the manufacturer or provider.

• Receive meeting deliverables
  • Receive (and decrypt if required) the meeting deliverables from the CAB.
  • Archive and store the meeting deliverables in the NCCA document management system.

• Check for completeness
  • Check meeting deliverables for completeness.

• Confirm participation
  • Determine if the ERM needs to be attended based on the content of the meeting deliverables.
  • Send a message to the CAB indicating the participation and where appropriate request any missing information in the meeting deliverables.

• Receive meeting deliverables
  • Receive (and decrypt if required) the meeting deliverables from the CAB.

• Confirm participation
  • Determine if the ERM needs to be attended.
  • Send a message to the CAB indicating the participation.

• ERM will be held
  • The certifier chairs the meeting using the agenda defined by the assessment plan.
  • The ERM deliverables are presented by the evaluator, according to the following guidance:
    • The certifier may question the evaluator on any or all of the items to ascertain that the evaluation was performed correctly and completely.
    • If there are any missing items in the ERM deliverables, or items that are not clear, these will be corrected during the meeting, by amending the ERM deliverables where possible and annotating them where amending would take too much time.
    • In exceptional cases the certifier may, in agreement with the certification auditor (if present), decide that presentation of (parts of) ERM deliverables is skipped as they are deemed to be self-explanatory.
  • The meeting can have four possible outcomes:
    • All ERM deliverables were either correct or successfully amended/annotated during the meeting. In this case all of these deliverables are provisionally approved.
    • One or more deliverables could not be successfully amended/annotated, but the certifier determines that this can be further handled by email. In this case, the other deliverables are provisionally approved, and after an email process, where the remaining deliverables are amended/annotated will also be provisionally approved.
    • One or more deliverables could not be successfully amended/annotated and cannot be handled by email, but the certifier determines that this can be rescheduled to the next ERM. In this case, the other deliverables are provisionally approved, and the remaining deliverables are rescheduled (for the final ERM this outcome is not possible and will lead to outcome 4).
    • One or more deliverables could not be successfully amended/annotated and the certifier determines that this cannot be handled by email or rescheduling. In this case, the ERM is nullified, and must be repeated once the evaluator has remedied the not-approved deliverables.

Note: ERM deliverables can only be provisionally approved as subsequent ERMs may invalidate the verdicts due to new information found. The final formal approval takes place in Step 2.4: Generate final evaluation & certification reports.

• Create meeting minutes
  • Either the certifier or the evaluator will draft meeting minutes to record all issues raised during the meeting, the decisions made and the conclusion. The meeting minutes shall contain the following topics:
    • The date, duration, location and attendees of the meeting;
    • All evaluator evidence including the Certifier Review Report that has been delivered for discussion at the ERM shall be listed by name and version;
    • Intermediate conclusions or verdicts and decisions made in regard to a specific deliverable shall be recorded (i.e. amended/annotated during meeting, further handling by email or renewed discussion of the issue at a rescheduled meeting);
    • All revised evaluator evidence including the Certifier Review Report coming out of the ERM shall be listed by name and version. Ideally, outputs of a meeting, should be attachments to the meeting minutes;
    • The final conclusion of the meeting (see the 4 possible outcomes of a meeting as described in previous step);
    • A reference to the (updated) project action list arising from the meeting.
  • Either the certifier or the evaluator will create (or update) the project actions list based on the actions that were agreed upon during the ERM. This project actions list shall meet the following requirements:
    • Every action is uniquely identified in order to trace the action;
    • When an action relates to a evaluator evidence, the action should refer to the specific deliverable, including its version and location within that deliverable (e.g. section number, slide number);
    • Every action should be self-explanatory, not relying on (undocumented) discussion in the meeting for clarity;
    • When an action is closed, the action item should clearly state how the actions was closed, e.g. by reference to the specific deliverable from the evaluator evidence in where the action was closed;
    • Per action item it shall be noted whether and when the certifier has approved its closure.
  • Send the meeting minutes and the updated project actions list to the meeting participants for confirmation (and in case of no NCCA participation: to the NCCA for information).
  • Revise the meeting minutes and project actions list based on comments received.

Note 1: No full meeting minutes are required to record every aspect of discussion, but rather these minutes serve as a record summary of issues discussed, the verdicts and conclusions made during the meeting.

Note 2: The meeting minutes and updated project actions list needs to be provided within 3 working days after the meeting.

• Finalise all evaluator evidence
  • If not already done so for the final ERM, generate the Evaluation Technical Report (ETR) to collate all evaluator evidence and provide a conclusion of the overall verdict of the evaluation findings. Also generate a ETRfC, STAR and analysis of the ST-Lite, as applicable in accordance with the assessment plan.
  • Revise any evaluator evidence necessary to close action items from the project action list, documenting a disposition of how they have been addressed.

• Verify all final evaluator evidence
  • Once all verdicts are Pass and the evaluator considers all action items addressed, the final package of evaluator evidence (including ETR and other documents) needs approval and authorization before submitting for formal CAB review.

• Submit all final evaluator evidence
  • Send the final package of evaluator evidence, along with the project actions list, and a copy of the final ST (and ST-Lite, if applicable) to the certifier for formal review.

• Receive final package of evaluator evidence, the project actions list, and final ST (and ST-Lite if applicable) from the evaluator
  • Ensure documents received are recorded in accordance with the ISO/IEC 17065.

• Review final package of evaluator evidence
  • Determine whether all open action items from the project actions list have been addressed, and confirm closure or record items still not satisfactorily addressed in a Certifier Review Report.
  • Review all finalised evaluator evidence, ETR and other documents, and record any comment in a Certifier Review Report. The review must ensure that the evaluator conclusions are consistent with the evidence adduced and that the accepted evaluation criteria and evaluation methods have been correctly applied.
  • Check the final ST (and ST-Lite if applicable) for consistency with the final package of evaluator evidence and ensure that all ASE related comments are addressed.

• Deliver Certifier Review Report to the evaluator and the certification auditor along with the associated package of evaluator evidence
  • If there are comments that require an update of the evaluator evidence, the Certifier Review Report is sent directly to the evaluator for the comments to be addressed and in copy to the certification auditor. This would require an iteration of Action 2.4.1: Create final evaluator evidence and Action 2.4.2: Review final evaluator evidence.

• Close Review Reports
  • Once the certifier has confirmed all comments recorded in the Certifier Review Report have been closed, it can be closed with a formal acceptance of the evaluation work.

• Generate certification report
  • Create a draft version of the Certification Report.
  • Check consistency with the mandatory EUCC content and format requirements of certification reports (ref. EUCC Annex V).

• Create certificate
  • Create draft version of the Certificate.
  • Check consistency with the mandatory EUCC content and format requirements of certificates (ref. EUCC Annex VII and VIII).
  • Check EUCC validity requirements (ref. EUCC article 12), and update the certificate validity as appropriate.

• Send draft certification report and certificate for review
  • Submit the draft Certification Report and draft certificate for review and acceptance to the evaluator (and in copy to the sponsor).

• Receive draft certification report and draft certificate
  • Receive the draft Certification Report and draft certificate from the certifier.

• Assess draft certification report and draft certificate
  • Check the draft certification report for:
    • Correctness with the ST/PP and ETR, and any other inconsistencies
    • Proprietary information that is unsuitable for publication
  • Check the draft certificate for correctness with the ST/PP and ETR, and any other inconsistencies
  • Consult with the sponsor and accept the draft certification report and draft certificate.

• Send review comments and/or acceptance to the certifier
  • The evaluator sends the review comments and/or acceptance to the certifier after consulting the sponsor.

• Finalise certification report
  • Receive comments and/or acceptance from the evaluator (and sponsor).
  • Update certification report and certificate based on received comments.

• Decide on certification
  • In accordance with ISO/IEC 17065 the CAB needs to take a formal decision on certification based on the evaluation results and the review thereof.

• Draft request for approval
  • Once the certification decision is positive, download the Request for approval form from the NCCA website.
  • Fill in the required fields.
  • Sign the request for approval.

• Submit request
  • Gather the following documents:
    • The final ETR, including the underlying evaluator evidence (and the ETRfC and STAR if applicable)
    • The final ST (and ST-Lite if applicable)
    • The link to the sponsor’s website containing the supplementary cybersecurity information referred to in article 55 of the CSA
    • The Certifier Review Report(s) including the project actions list with the agreed dispositions
    • The certification report
    • The draft certificate
  • Send the request for approval form and the documents mentioned above to the NCCA.

• Receive the request for approval
  • Receive (and decrypt if required) the request for approval form, and:
    • The final ETR, including the underlying evaluator evidence (and the ETRfC and STAR if applicable)
    • The final ST (and ST-Lite if applicable)
    • The link to the sponsor’s website containing the supplementary cybersecurity information referred to in article 55 of the CSA
    • The Certifier Review Report(s) including an overview of the disposition of action items
    • The certification report
    • The draft certificate
  • Archive and register the request for approval and associated documents in the NCCA document management system.
  • Confirm the reception of the request for approval to the CAB.

• Create Approval Review Report
  • Create an Approval Review Report to document any discussions and comments related to the notification.

Note: The Approval Review Report is intended to collect findings on the request for approval document, and forms the basis for the formal approval or rejection to issue a certificate.

• Check the request for approval for completeness
  • Perform a high level check on the following items as a minimum:
    • Does the request for approval include all required documents?
    • Are all required fields in the request for approval form filled in?
    • Is the request for approval form signed by the CAB?
    • Is the accreditation of the CAB still valid (i.e. not suspended or revoked)?
    • Is the CAB still authorised?
  • Notify CAB in case the request for approval is incomplete and request missing information.
  • Update the Approval Review Report with findings.
  • Continue with Action 3.1.4: Issue formal approval or rejection to issue certificate in case the request for approval remains incomplete. This will lead to a rejection to issue a certificate. Otherwise continue with Action 3.1.3: Review ETR, CR and certificate.

• Inform external expert
  • If an external expert is involved, provide the external expert with the request for approval and associated documents.

• Review the Certifier Review Report(s) and overview of the disposition of action items
  • Perform a detailed review of the Certifier Review Report(s) and overview of the disposition of action items based on the Approval review checklist and the knowledge gained while attending the ERMs (if applicable). Focus areas are:
    • Determination that the certifier did a thorough review of the final ETR, including the underlying evaluator evidence and the ETRfC and STAR if applicable. Check that the certifier has verified the:
      • Correct application of the evaluation methodology;
      • Correctness of the completed evaluator checklist;
      • Consistency in version numbers of the final ETR, including the underlying evaluator evidence and the ETRfC and STAR if applicable, the product evaluated, including the ST (and ST-Lite if applicable) and its guidance documentation.
    • Closure and correct disposition of the action items.
  • Discuss any items that are unclear with the CAB to gain necessary clarification in order to finalise the review.
  • Update the Approval Review Report with findings.

• Review the certification report and draft certificate
  • Perform a detailed review of the certification report and draft certificate based on the Approval review checklist. Focus areas are:
    • Consistency with the ETR, including version numbers.
    • Consistency with the mandatory content and format requirements of EUCC scheme certificates and certification reports.
  • Discuss any items that are unclear with the CAB to gain necessary clarification in order to finalise the review.
  • Update the Approval Review Report with findings.

• Review the executed evaluation and certification process
  • Check that the evaluation and certification process was executed in conformance with the approved assessment plan.
  • Update and finalise the Approval Review Report with findings.

• Validation of the Approval Review Report
  • Check if the Approval Review Report is complete, correct and consistent.
  • Sign off the Approval Review Report.

• Draft a formal approval or rejection letter
  • Fill-in the applicable NCCA letter template.
  • Have the applicable letter signed.

• Submit the formal approval or rejection letter to the CAB
  • Send the letter to the CAB.

• Receive approval to issue certificate
  • Record approval in accordance with the applicable certification procedure.

• Pre-notify ENISA
  • Request ENISA for a specific EUCC mark and label, including a QR-code to be placed on the certificate.

Note: ENISA will develop a procedure for the release of the EUCC mark and label, including the QR code. This most likely will involve the CAB to provide a XML file containing information derived from the Certification Report.

• Update certificate
  • Update the certificate with the EUCC mark and label.

• Sign certificate
  • Have the certificate signed by an authorised person.

• Register certification
  • Add the certification to the directory of certified products.
  • Publish the certification on the CAB’s website (when appropriate).

• Close certification files
  • Finish certification project and archive all files in accordance with applicable certification procedures.

Note: In accordance with EUCC (article 40), all records shall be securely and accessibly stored for a period of at least five (5) years after the withdrawal of the certificate.

• Notify Sponsor
  • Inform sponsor that the certificate has been issued.
  • Send certificate in electronic form to the sponsor. A paper version may additionally be provided.

• Notify NCCA
  • Inform NCCA that the certificate has been issued.
  • Send certificate, certification report and final ST(ST-Lite)/PP in PDF-form to the NCCA.

• Notify ENISA
  • Inform ENISA that the certificate has been issued.
  • Send certificate, certification report and final ST(ST-Lite)/PP in PDF-form to ENISA in accordance to their prescribes procedures.

• Receive certificate and related documents
  • Receive the certificate, certification report and final ST(ST-Lite)/PP.
  • Archive and register the documents in the NCCA document management system.

• Publish certification on CCRA website⁴
  • Publish the certificate, certification report and final ST(ST-Lite)/PP on the commoncriteriaportal.org website.
    • Login to the member section of the CCRA website
    • Go to CCRA area
    • Add certification record and complete web entry.
  • Notify sponsor and CAB that the certification has been published on the CCRA website.

• Close audit file
  • Close the project in the NCCA document management system.