Common Criteria evaluations have traditionally been performed against a set of Evaluated Assurance Levels (EALs). The assurance levels reflect added assurance requirements that must be met to achieve Common Criteria certification. Note that the EAL levels indicate to what assurance package the product was tested with and not that the product itself is more secure.

EAL based evaluations have been criticized for being time-consuming while modern software systems are progressing rapidly, which can lead to a software version already becoming outdated when the Common Criteria certificate is finally issued. In response, Common Criteria has introduced the collaborative Protection Profile (cPP) based approach to provide achievable, repeatable, testable evaluation results and facilitate easier comparison among certified products.

The restructuring of the certification approach means that when certifying a product against most cPPs there are no EALs defined. Note that when reviewing a specification of an ongoing cPP evaluation, the assurance package is typically specified in the format "EAL 1 ASE_SPD.1". If you are used to traditional Protection Profiles, the format can easily be misinterpreted as indicating a low level, while it is the exact level specified in the collaborative Protection Profile. Currently, both EAL and non-EAL based evaluations are being performed, causing confusion in the market.

The relevant distinction is that a PP’s security functional requirements (SFRs) describe the security functionalities of a product, while the security assurance requirements (SARs) define the level of effort (CC Part 3, §6.3) required during the evaluation process. Adequacy of a product to a given field is hence contained in the PP’s SFRs, not by the (optional) SARs. The collaborative Protection Profile for Certification Authorities is intended to provide a minimal, baseline set of requirements that are targeted at mitigating well defined and described threats. It contains 78 SFRs and abundantly uses the so-called “extended components” which specializes in the standard CC SFRs to the PKI domain. In these extended components, the added assurance activities augment the assurance requirements beyond those of EAL1 and ensure that these extended SFRs are evaluable with activities that can be considered focused versions of SARs with Independent Testing.

For more information, refer to Common Criteria for Information Technology Security Evaluation .