2020 Common Criteria Statistics Report
2
min reading time
Majority of CC certifications by the Italian scheme was delivered by CCLab
We are proud to share that 7 out of the 12 Common Criteria certifications in 2020 under the Italian scheme (OCSI) were issued based upon CCLab evaluations. 2020 was an unusual year in the business world due to the pandemic caused by COVID19. However, for the CC community and also for CCLab it was a successful year looking at the number of Common Criteria certifications achieved.
2020 was the second-best year ever since the international Common Criteria methodology was created with 388 certified products. In total, 187 high assurance evaluations (EAL4-EAL7) were carried out. Among those, we can find 72 EAL4 evaluations, 84 EAL5 evaluations, 30 EAL6 evaluations, and 1 EAL7 evaluation. Here we can mention that 6 out of the 72 EAL4 evaluations were delivered by CCLab.
A total of 82 products were certified using low assurance evaluations (EAL1-EAL3). The most frequent low assurance level was EAL2, with 57 certifications. CCLab delivered 1 of these in 2020.
On the other hand, the trend to use Protection Profiles on evaluations has been even larger in 2020. In total, 119 products were certified with a Protection Profile without assigned EAL. (Source: 2020 Common Criteria Statistics Report)
We are pleased to announce that CCLab helped to achieve 7 Common Criteria certifications for 4 customers, among which 2 (ID & Trust and I4P Informatics Ltd.) were returning customers.
The following 7 Common Criteria evaluations by CCLab were deemed to be worthwhile by OCSI with a certificate in 2020:
Developer: Forcepoint
26 May 2020
Assurance level CC: EAL4 + ALC_FLR.2
Read more HERE
Developer: I4P-informatikai Kft. (I4P Informatics Ltd.)
2 September 2020
Assurance level CC: EAL4 + AVA_VAN.5, ALC_FLR.3
Read more HERE
Nutanix Enterprise Cloud (AOS & AHV) v5.15
Developer: Nutanix, Inc.
9 October 2020
Assurance level CC: EAL2 + ALC_FLR.2
Read more HERE
IDentity Applet v3.4 / eIDAS on NXP JCOP 4 P71
IDentity Applet v3.4 / QSCD on NXP JCOP 4 P71
IDentity Applet v3.4 / PACE-EAC1 on NXP JCOP 4 P71
IDentity Applet v3.4 / BAC on NXP JCOP 4 P71
Developer: ID & Trust Ltd.
28 October 2020
Assurance level CC: EAL4 +
Read more HERE
Congratulations to our respected clients for the successful product certifications and we also look forward to future collaborations.
Related downloadables
Related downloadables
Common Criteria Evaluation Process infographics
Common Criteria Evaluation Process infographics
This downloadable infographics introduces the Common Criteria Evaluation process to you. Explore now for free.
Guide and Checklist for Common Criteria Evaluations - updated with EUCC Scheme
Guide and Checklist for Common Criteria Evaluations - updated with EUCC Scheme
Learn everything you need to know for a successful Common Criteria certification project. Save costs and effort with your checklist.
ETSI EN 303 645 infographics for Consumer IoT devices
ETSI EN 303 645 infographics for Consumer IoT devices
Download our ETSI EN 303 635 infographics today and learn about the product certification process for this consumer IoT device cybersecurity standard.
Related news
Understanding EUCC Assurance Levels: What “Substantial” and “High” Really Mean for ICT Security
This article provides a strategic guide to the new EUCC assurance levels, explaining what "Substantial" and "High" certifications actually mean for your market access. It demystifies the critical shift from simple EAL numbers to risk-based vulnerability analysis (AVA_VAN), detailing exactly which products require advanced penetration testing versus basic surveys. You will learn how to map your device to the correct assurance category, navigate the new mandatory lifecycle and patching requirements, and avoid the costly trap of over-engineering your compliance strategy.
5
min reading time
Implementing EUCC: What High-Assurance Certification Requires Beyond Traditional Common Criteria Approaches
This is a comprehensive overview of the transition to EUCC (European Common Criteria-based cybersecurity certification scheme). It effectively highlights the shift from the old, fragmented SOG-IS approach to a unified, risk-based framework under the Cybersecurity Act.
8
min reading time
Cyber Resilience Act & EUCC Explained: Key Differences, Overlaps and Compliance Pathways
As the 11 September 2026 reporting deadline approaches, understanding the Cyber Resilience Act (CRA) is essential for all manufacturers of digital products. This blog post explores the key differences and overlaps between the CRA and the EUCC certification scheme, providing a clear roadmap for compliance, risk categorization, and long-term market access.
9
min reading time
