CONTENT OF A CERTIFICATION REPORT
ANNEX VSupplementary provisions
ANNEX V CONTENT OF A CERTIFICATION REPORT V.1 Certification report 1. On the basis of the evaluation technical reports provided by the ITSEF, the certification body establishes a certification report to be published together with the corresponding EUCC certificate. 2. The certification report is the source of detailed and practical information about the ICT product or the category of ICT products and about the ICT product’s secure deployment and shall therefore include all publicly available and sharable information of relevance to users and interested parties. Publicly available and sharable information can be referenced by the certification report. 3. The certification report shall at least contain the following sections: (a) executive summary; (b) identification of the ICT product or the ICT product category for protection profiles; (c) security services; (d) assumptions and clarification of scope; (e) architectural information; (f) supplementary cybersecurity information, if applicable; (g) ICT product testing, if it was performed; (h) where applicable, an identification of the certificate holder’s lifecycle management processes and production facilities; (i) results of the evaluation and information regarding the certificate; (j) summary of the security target of the ICT product submitted to certification; (k) when available, the mark or label associated to the scheme; (l) bibliography. 4. The executive summary shall be a brief summary of the entire certification report. The executive summary shall provide a clear and concise overview of the evaluation results and shall include the following information: (a) name of the evaluated ICT product, enumeration of the product’s components that are part of the evaluation and the ICT product version; (b) name of the ITSEF that performed the evaluation and, where applicable, the list of subcontractors; (c) completion date of evaluation; (d) reference to the evaluation technical report established by the ITSEF; (e) brief description of the certification report results, including: (1) the version and if applicable release of the Common Criteria applied to the evaluation; (2) the Common Criteria assurance package and security assurance components including the AVA_VAN level applied during the evaluation and its corresponding assurance level as set out in Article 52 of Regulation (EU) 2019/881 to which the EUCC certificate refers to; (3) the security functionality of the evaluated ICT product; (4) a summary of threats and organisational security policies addressed by the evaluated ICT product; (5) special configuration requirements; (6) assumptions about the operating environment; (7) where applicable, the presence of an approved patch management procedure in accordance with Section IV.4 of Annex IV; (8) disclaimer(s). 5. The evaluated ICT product shall be clearly identified, including the following information: (a) the name of the evaluated ICT product; (b) an enumeration of the ICT product’s components that are part of the evaluation; (c) the version number of the ICT product’s components; (d) identification of additional requirements to the operating environment of the certified ICT product; (e) name and contact information of the holder of the EUCC certificate; (f) where applicable, the patch management procedure included into the certificate; (g) link to the website of the holder of the EUCC certificate where supplementary cybersecurity information for the certified ICT product in accordance with Article 55 of Regulation (EU) 2019/881 is provided. 6. The information included in this Section shall be as accurate as possible in order to ensure a complete and accurate representation of the ICT product that can be re-used in future evaluations. 7. The security policy section shall contain the description of the ICT product's security policy and the policies or rules that the evaluated ICT product shall enforce or comply with. It shall include a reference and a description of the following policies: (a) the vulnerability handling policy of the holder of the certificate; (b) the assurance continuity policy of the holder of the certificate. 8. Where applicable, the policy may include the conditions related to the use of a patch management procedure during the validity of the certificate. 9. The section for the assumptions and clarification of scope shall contain exhaustive information regarding the circumstances and objectives related to the intended use of the product as referred to in Article 7(1), point (c). The information shall include the following: (a) assumptions on the ICT product’s usage and deployment in the form of minimum requirements, such as proper installation and configuration and hardware requirements being satisfied; (b) assumptions on the environment for the compliant operation of the ICT product; 10. The information listed in point 9 shall be as understandable as possible in order to let users of the certified ICT product make informed decisions about the risks associated with its use. 11. The architectural information section shall include a high-level description of the ICT product and its main components in accordance with Common Criteria’s ADV_TDS subsystems design. 12. A complete listing of the ICT product supplementary cybersecurity information shall be provided in accordance with Article 55 of Regulation (EU) 2019/881. All relevant documentation shall be denoted by the version numbers. 13. The ICT product testing section shall include the following information: (a) the name and point of contact of the authority or body that issued the certificate including the responsible national cybersecurity certification authority; (b) the name of the ITSEF which performed the evaluation, when different from the certification body; (c) an identification of the used assurance components from the standards referred by Article 3; (d) the version of the state-of-the-art document and further security evaluation criteria used in the evaluation; (e) the complete and precise settings and configuration of the ICT product during the evaluation, including operational notes and observations if available; (f) any protection profile that has been used, including the following information: (1) the author of the protection profile; (2) the name and identifier of the protection profile; (3) the identifier of the protection profile’s certificate; (4) the name and contact details of the certification body and of the ITSEF involved in the evaluation of the protection profile; (5) the assurance package(s) required for a product conforming to the protection profile. 14. The results of the evaluation and information regarding the certificate section shall include the following information: (a) confirmation of the attained assurance level as referred to in Article 4 of this Regulation and Article 52 in Regulation (EU) 2019/881; (b) assurance requirements from the standards referred by Article 3 that the ICT product or protection profile actually meets, including the AVA_VAN level; (c) detailed description of the assurance requirements, as well as the details of how the product meets each of them; (d) date of issuance and period of validity of the certificate; (e) unique identifier of the certificate. 15. The security target shall be included in the certification report or referenced and summarised in the certification report and provided with the certification report association with it for the purposes of publication. 16. The security target may be sanitised in accordance with Section VI.2. 17. The mark or label associated to the EUCC may be inserted the certification report in accordance with the rules and procedures laid down Article 11 18. The bibliography section shall include references to all documents used in the compilation of the certification report. That information shall include at least the following: (a) the security evaluation criteria, state-of-the-art documents and further relevant specifications used and their version; (b) the evaluation technical report; (c) the evaluation technical report for composite evaluation, where applicable; (d) technical reference documentation; (e) developer documentation used in the evaluation effort. 19. In order to guarantee the reproducibility of the evaluation, all documentation referred to has to be uniquely identified with the proper release date, and proper version number. V.2 Sanitization of a security target for publication 1. The security target to be included in or referenced by the certification report pursuant to point 1 of Section VI.1 may be sanitised by the removal or paraphrasing of proprietary technical information. 2. The resulting sanitised security target shall be a real representation of its complete original version. This means that the sanitised security target cannot omit information which is necessary to understand the security properties of the target of evaluation and the scope of the evaluation. 3. The content of the sanitised security target shall conform to the following minimum requirements: (a) its introduction shall not be sanitised as it includes no proprietary information in general; (b) the sanitised security target has to have a unique identifier that is distinct from its complete original version; (c) the target of evaluation description may be reduced as it may include proprietary and detailed information about the target of evaluation design which should not be published; (d) the target of evaluation security environment description (assumptions, threats, organisational security policies) shall not be reduced, in so far as that information is necessary to understand the scope of the evaluation; (e) the security objectives shall not be reduced as all information is to be made public to understand the intention of the security target and target of evaluation; (f) all security requirements shall be made public. Application notes may give information on how the functional requirements of the Common Criteria as referred to in Article 3 were used to understand the security target; (g) the target of evaluation summary specification shall include all target of evaluation security functions but additional proprietary information may be sanitised; (h) references to protection profiles applied to the target of evaluation shall be included; (i) the rationale may be sanitised to remove proprietary information. 4. Even if the sanitised security target is not formally evaluated in accordance with the evaluation standards referred to in Article 3, the certification body shall ensure that it complies with the complete and evaluated security target, and reference both the complete and the sanitised security target in the certification report.