• Target of Evaluation (TOE) – the product or system that is the subject of the evaluation. The evaluation serves to validate claims made about the target. To be of practical use, the evaluation must verify the target's security features. This is done through the following:
• Protection Profile (PP) – a document, typically created by a user or user community, which identifies security requirements for a category/type of security devices (for example, smart cards used to provide digital signatures, or network firewalls) relevant to that user for a particular purpose. Product vendors can choose to implement products that comply with one or more PPs, and have their products evaluated against those PPs. In such a case, a PP may serve as a template for the product's ST (Security Target, as defined below), or the authors of the ST will at least ensure that all requirements in relevant PPs also appear in the target's ST document. Customers looking for particular types of products can focus on those certified against the PP that meets their requirements.

• Security Target (ST) – the document that identifies the security properties of the target of evaluation. The ST may claim conformance with one or more PPs. The TOE is evaluated against the SFRs (Security Functional Requirements. Again, see below) established in its ST, no more and no less. This allows vendors to tailor the evaluation to accurately match the intended capabilities of their product. This means that a network firewall does not have to meet the same functional requirements as a database management system, and that different firewalls may in fact be evaluated against completely different lists of requirements. The ST is usually published so that potential customers may determine the specific security features that have been certified by the evaluation.

• Security Functional Requirements (SFRs) – specify individual security functions which may be provided by a product. The Common Criteria presents a standard catalogue of such functions. For example, a SFR may state how a user acting a particular role might be authenticated. The list of SFRs can vary from one evaluation to the next, even if two targets are the same type of product. Although Common Criteria does not prescribe any SFRs to be included in an ST, it identifies dependencies where the correct operation of one function (such as the ability to limit access according to roles) is dependent on another (such as the ability to identify individual roles).

1. Class FAU: Security Audit 
2. Class FCO: Communication 
3. Class FCS: Cryptographic support 
4. Class FDP: User Data Protection 
5. Class FIA: Identification and Authentication 
6. Class FMT: Security Management 
7. Class FPR: Privacy 
8. Class FPT: Protection of the TSF 
9. Class FRU: Resource Utilization 
10. Class FTA: TOE Access 
11. Class FTP: Trusted Path/Channels 

The evaluation process also tries to establish the level of confidence that may be placed in the product's security features through quality assurance processes:

• Security Assurance Requirements (SARs) – descriptions of the measures taken during development and evaluation of the product to assure compliance with the claimed security functionality. For example, an evaluation may require that all source code is kept in a change management system, or that full functional testing is performed. The Common Criteria provides a catalogue of these, and the requirements may vary from one evaluation to the next. The requirements for particular targets or types of products are documented in the ST and PP, respectively.

1. Class APE: Protection Profile Evaluation 
2. Class ASE: Security Target Evaluation 
3. Class ADV: Development 
4. Class AGD: Guidance Documents 
5. Class ALC: Life-Cycle Support 
6. Class ATE: Tests 
7. Class AVA: Vulnerability Assessment 
8. Class ACO: Composition 

• Evaluation Assurance Level (EAL) – the numerical rating describing the depth and rigor of an evaluation. Each EAL corresponds to a package of security assurance requirements (SARs, see above) which covers the complete development of a product, with a given level of strictness. Common Criteria lists seven levels, with EAL 1 being the most basic (and therefore cheapest to implement and evaluate) and EAL 7 being the most stringent (and most expensive). Normally, an ST or PP author will not select assurance requirements individually but choose one of these packages, possibly 'augmenting' requirements in a few areas with requirements from a higher level. Higher EALs do not necessarily imply "better security", they only mean that the claimed security assurance of the TOE has been more extensively verified.

During the evaluation, the verbs check, examine, report and record are used with a precise meaning in the CEM.

Who should apply

1. The ICT product developer;
2. The ICT product manufacture. 

• Choose a reputable CC certification body (Certificate Authorizing Members)

• Choose a trustworthy CC laboratory