It has been two years since the EU Common Criteria (EUCC) certification scheme was adopted and a year since the EUCC has been up-and-running. Since our post about establishing our Conformity Assessment Body (CAB), atsec already has multiple certifications in progress, covering both assurance levels – substantial and high.
atsec CB is both accredited and authorized to issue certificates up to AVA_VAN.4, which corresponds to assurance level high in EUCC, and EAL5 in terms of the standard Common Criteria. Additionally, the atsec CB has already formally approved two of the atsec IT Security Evaluation Facilities (ITSEFs) in Europe as they finalize their accreditation and authorization in their respective countries: atsec AB, in Sweden, and atsec GmbH, in Germany. atsec CB will work on projects with both of these ITSEFs.
At the start of March 2026, the national schemes that previously existed in the EU may no longer produce new certificates, meaning that the only Common Criteria scheme with mutual recognition in the EU is the EUCC. atsec has, over the last 25 years, worked with several of these schemes, namely the Swedish (CSEC) scheme, the German (BSI) scheme, and the Italian (OCSI) scheme. As a thank you to these schemes, we want to look back and summarize these years:
- The first scheme atsec did evaluations under was the BSI scheme, all the way back in 2002. Since then, atsec completed more than 122 evaluations together with BSI, for multiple PPs and Evaluation Assurance Levels (EAL) up to EAL5+.
- In 2009, atsec completed its first evaluation under the CSEC scheme – a Firewall with VPN functionality at EAL4+. atsec maintained a good working relationship with CSEC ever since and completed more than 91 evaluations under their scheme, from EAL1 up to EAL5+.
- The third European scheme atsec worked with is the OCSI scheme, with the first evaluation completed in 2017. In total, more than 23 evaluations were completed under this scheme, all the way up to EAL5.
A few other noteworthy numbers from atsec’s work within these three schemes:
- More than 238 completed evaluations
- 52 products from those evaluations listed on the NIAP PCL
- 33 with the CSEC scheme
- 4 with the BSI scheme
- 15 with the OCSI scheme
And while this is the end of national schemes, it is only the beginning of the EUCC: As previously mentioned, atsec CB has already started a number of EUCC certification projects and there are more on the horizon. We are excited to continue working with the global Common Criteria community, and to maintain the high quality of certifications that Sweden has produced for many years. We also look forward to continuing to work with CSEC as a licensed CAB under “CCRA and EUCC Co-existence”.
For more information about our EUCC certification, please visit our Common Criteria certification page or reach out to info@atsec.com.
