Common criteria for information technology security evaluation

Home page
Common criteria for information technology security evaluation

The module provides an in-depth overview of the international standard for assessing the security of IT systems, with a particular focus on the theoretical and practical aspects of the framework. The fundamental concepts are introduced, with an analysis of key terms such as Target of Evaluation (TOE), Security Functional Requirements (SFRs) and Security Assurance Requirements (SARs). The structure of the framework is then explained, along with how it is applied in different assessment contexts. Particular attention is paid to the Protection Profile (PP), which is the document that defines the generic security requirements for a category of products, highlighting its importance and the process involved in creating it. The module then examines in detail the definition and role of the Target of Evaluation, i.e. the specific set of security functions and technologies being assessed. Using practical examples, participants learn to identify the key features of the TOE and how to document them effectively.

A significant part of the programme focuses on the assessment process, outlining its main stages: from initial planning, through technical verification, to official certification. The roles and responsibilities of all parties involved, including developers, assessors and certification bodies, are analysed.

Finally, the course provides practical tools for applying the Common Criteria in real-world contexts, equipping participants to develop, evaluate and certify products in accordance with the standard’s requirements. With the ultimate aim of ensuring that the process is safe, reliable and compliant with regulations.

The module is divided into two parts, each comprising 20 hours of distance learning, making a total of 40 hours, plus 16 hours of in-person laboratory work. 

Would you like to attend the course live with the tutor? Download the course timetable and get in touch

Topics

 

  • ISO and the main international standards related to the Common Criteria
  • Target of Evaluation, Security Target and Protection Profile;
  • CAP and composite TOE
  • Assurance Continuity Assessment
  • National and European evaluation schemes and EUCC

Target

  • Assessment laboratories included in the “National Scheme for the Assessment and Certification of Information Technology Security for the Protection of Classified Information Concerning the Internal and External Security of the State” (Prime Ministerial Decree of 11 April 2002) managed by the PCM, within the “National Scheme for the Assessment and Certification of Security in the Information Technology Sector, pursuant to Article 10(c)(1) of Decree-Law No. 10/2002” (Prime Ministerial Decree of 30 October 2003) managed by OCSI, or in that of the National Cyber Security Perimeter (Legislative Decree No. 105 of 21 September 2019) managed by ACN
  • Companies wishing to enter the market to supply ICT products and systems and which intend to obtain certification. In this case, specialist staff are essential to lead the process of developing and integrating products or systems, and to ensure that the quality of the safety measures is such that they can easily pass the tests required for safety certification

Course structure

Module 1 - INTRODUCTION MODULE
20 hours
  • General introduction
  • Assessment and certification
  • Basic technical terms (TOE, PP, SFR, SAR, EAL/CAP, VA&PT)
  • National and European schemes and multinational agreements
  • National Cyber Security Framework (PSNC)
  • Laboratory accreditation
Module 2 - ADVANCED MODULE
20 hours
  • Specific terms used in the Curriculum and document structure
  • Document structure
  • Key Learning Outcomes
  • Assessment procedures at EAL1 and EAL2 and differences
  • Final Assessment Report (FAR)
Workshop
16 hours
  • The aim is to learn how to use the tools set out in Volume II of the Common Criteria on Security Function Requirements (SFRs) in order to draft supporting documentation for developed or integrated products/systems, and with Volume III of the Common Criteria on Security Assessment Requirements (SARs) for ICT systems; to carry out small-scale assessment activities at EAL1 and EAL2 levels using the CEM

  • Practical module: In-depth study, examples and exercises in writing ST/PP (CC Vol. II and IV)

Common criteria for information technology security evaluation

Index

Request more information

Request more information

Fill in all sections of the form and click CONFIRM.

You may also be interested in…

Retail frameworks and standards for cyber risk assessment

Open frameworks and standards for cyber risk assessment