Common Criteria Recognition Arrangement (CCRA) and Mutual Recognition
The Common Criteria Recognition Arrangement (CCRA) was established in 1998 for each Participant of the arrangement to recognise a Common Criteria certificate awarded by a certificate authorising Participant. Initially the CCRA comprised Canada, France, Germany, the United Kingdom and the United States. It now currently includes 26 nations. Australia and New Zealand joined the CCRA in 1999.
Consumers can be confident that each certificate authorising Participant of the CCRA ensures that evaluations are performed to high and consistent standards. This arrangement for recognising standards of IT security certification between member countries is called Mutual Recognition (MR) and eliminates the need for duplicating an evaluation. This agreement is at present limited to the first four security levels of the CC: EAL1 to EAL4, without cryptographic functionality. Certifications governed by this arrangement are treated as being included on the Defence Signals Directorate (DSD) Evaluated Products List (EPL). Products certified above CC EAL4 by another CCRA scheme, are considered in terms of fulfilling Information Security Manual (ISM) requirements, to be at CC EAL4 assurance level.
Caveats may relate to the use of some products within Australian and New Zealand Government agencies. This applies particularly to products employing cryptography, which require an additional review by DSD, called a DSD Cryptographic Evaluation (DCE).
The Common Criteria website is available at29-Apr-2010SEC Mutual Recognition
Australia, New Zealand and the United Kingdom have agreed to recognise
their respective ITSEC certificates up to level E6. The following is a list of the CCRA certificate producing partners.CCRA Partners
Canada
Canadian Common Criteria Evaluation and Certification Scheme
PO Box 9703, Terminal
Ottawa, Canada K1G 3Z4
Tel: +1 613 991 7956
Fax: +1 613 991 7455
www.cse-cst.gc.ca
France
Direction Centrale de la Sécurité des Systèmes
d'Information
51 Boulevard de Latour-Maubourg
75700 PARIS 07 BP, France
Tel: +33 1 71758265
Fax: +33 1 71758260
www.ssi.gouv.fr Germany
Bundesamt fur Sicherheit in der
Informationstechnik
Referat 111 2.2
Godesberger Allee 185-189
53175 Bonn, Germany
Tel: +49 228 9582 111
Fax: +49 228 9582 455
www.bsi.bund.de
Japan
Japan Information Technology Security Evaluation and Certification
Scheme (JISEC)
Information Security Certification Office Information Technology
Promotion Agency (IPA)
Bunkyo Green Court center office
2-28-8 Hon-Komagome, Bunkyo-ku,
Tokyo 113-6591
Japan
Tel: +81-3-5978-7538
Fax: +81-3-5978-7548
http://www.ipa.go.jp
South Republic of Korea
Korea IT Security Evaluation and Certification Scheme (KECS).
IT Security Certification Centre (ITSCC)
Hansol B/D 10F, 736-1 Yeoksam-dong
Gangnam-gu, Seoul Korea
135-983
Tel.: +82-2-3412-3380
Fax: +82-2-557-1129
www.kecs.go.kr The Netherlands
TNO Certification
P.O. Box 541
7300 AM Apeldoorn
The Netherlands
Tel.: +31 55 549 34 68
Fax: +31 55 549 32 88
http://www.tno-certification.nl
Norway
Norwegian Certification Authority for IT Security (SERTIT)
SERTIT
P.O. Box 14
N-1306 BPD
Norway
Tel: +47 67 86 40 00
Fax: +47 67 86 40 09
www.sertit.no/
Spain
Organismo de Certificación de la Seguridad de las Technologías
de la Información
Centro Criptológico Nacional
Centro Nacional de Inteligencia
Ministerio de Defensa
Avda. Padre Huidobro, s/n
28023 Madrid
www.oc.ccn.cni.es/
Sweden
Swedish Defence materiel Administration (FMV)
Swedish Certificatio body for IT Security FMV/CSEC
S-115 88 Stockholm
Tel: +46 8 782 4000
Fax: +46 8 782 6905
www.csec.se
United Kingdom
UK IT Security Evaluation & Certification Scheme
PO Box 152
Cheltenham GL52 5UF, United Kingdom
Tel: +44 1242 238739
Fax: +44 1242 235233
www.cesg.gov.uk United States of America
National Information Assurance Partnership
Department of Defence
9800 Savage Road, Suite 6740
Ft. George Meade, MD 20755-6740, USA
Tel: +1 410 854 4458
Fax: +1 410 854 6615
http://www.niap-ccevs.org/