CRITERIA TO ASSESS THE ACCEPTABILITY OF ASSURANCE INFORMATION
ANNEX IISupplementary provisions
ANNEX II CRITERIA TO ASSESS THE ACCEPTABILITY OF ASSURANCE INFORMATION Name Object Points of attention EUCC ICT Products About the issuer: none (accredited certification bodies) About the scope: — Check the protection profile and security target — Check the evaluation assurance level and augmentations About the assurance: — Check restrictions in the user documentation — For composition, may require access to evaluation technical report EUCS (when available) Cloud services About the issuer: none (accredited certification bodies) About the scope: — Check the cloud service description — Check the evaluation level and extension profiles About the assurance: — Check the transparency information and, if needed, the composition information Common Criteria schemes operated in the EU, including SOG-IS schemes ICT products About the issuer: none (Member States) About the scope: — Check the protection profile and security target — Check the evaluation assurance level and augmentations About the assurance: — Check restrictions in the user documentation — For composition, may require access to evaluation technical report EN 17640:2018 (FITCEM, including CSPN, BSZ, LINCE, BSZA) ICT products About the issuer: — Check the scheme and the requirements for certification bodies About the scope: — Check the product description — Check the security claims — Check the assurance level About the assurance: — Check the activities performed and the findings in the report Certification schemes of qualified signature creation devices in accordance with Art. 30 of Regulation (EU) No 910/2014 QSCD About the issuer: — Check the scheme and the requirements for certification bodies About the scope: — Check the product description — Check the security claims — Check the assurance level About the assurance: — Check the activities performed EN ISO/IEC 27001:2022 ISMS About the issuer: none (Accredited certification bodies) About the scope: — Check the management system description — Check the statement of applicability About the assurance: — Check the activities performed SOC2 Organisations About the issuer: — Check their public accountant status About the scope: — Check the Management Statement and the description of the controls — Check the statement of applicability About the assurance: — Check the findings in the report — Check bridge letters if needed MDSCert (GSMA) (when available) Mobile Devices About the issuer: — Check the requirements for certification bodies About the scope: — Check the security assurance level — Check the scheme requirements About the assurance: — Check the activities and findings in the report Other schemes Any component About the scheme: — Check the relevance and provisions of the scheme About the issuer: — Check the requirements for certification bodies About the scope: — Check the scheme requirements — Check the security target or similar document describing the security functional and assurance requirements — Check the product description and selected security functional requirements About the assurance: — Check the activities and findings in the report