Common Criteria CC:2022

International (CCRA member schemes)

vCC:2022 Revision 1 (November 2022), Parts 1 and 2

11 domains

74 controls

The Common Criteria's catalogue of security functional requirements for IT products, CC:2022: 74 functional families across security audit, communication, cryptography, user data protection, identification and authentication, security management, privacy, protection of the security functionality, resource use, access and trusted channels, with Part 1's evaluation model as the frame.

Verified

Common Criteria CC:2022 is a compliance framework from International (CCRA member schemes) with 11 domains and 74 controls. The largest domains are Class FPT: Protection of the TSF – Common Criteria CC:2022 (16 controls), Class FDP: User data protection – Common Criteria CC:2022 (15 controls), Class FMT: Security management – Common Criteria CC:2022 (8 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (11)

Class FAU: Security audit – Common Criteria CC:2022

6 controls

Controls in the Class FAU: Security audit – Common Criteria CC:2022 domain of Common Criteria CC:2022: 6 controls
Code	Title	Description
common-criteria-cc-2022::FAU_ARP	Security audit automatic response	The TSF takes a defined action when it detects an event that points to a possible security violation. One component: FAU...
common-criteria-cc-2022::FAU_GEN	Security audit data generation	The TSF records security-relevant events that happen under its control: the family fixes the level of auditing, lists wh...
common-criteria-cc-2022::FAU_SAA	Security audit analysis	The TSF analyses system activity and audit data by automated means to find possible or actual security violations, feedi...
common-criteria-cc-2022::FAU_SAR	Security audit review	The TSF gives authorised users tools to read and interpret the audit data. Components: FAU_SAR.1 Audit review (specified...
common-criteria-cc-2022::FAU_SEL	Security audit event selection	The TSF can include or exclude events from the set actually audited during operation, chosen from the full set of audita...
common-criteria-cc-2022::FAU_STG	Security audit data storage	The TSF creates and keeps a secure audit trail. Components cover FAU_STG.1 Audit data storage location (where the trail...

Class FCO: Communication – Common Criteria CC:2022

2 controls

Controls in the Class FCO: Communication – Common Criteria CC:2022 domain of Common Criteria CC:2022: 2 controls
Code	Title	Description
common-criteria-cc-2022::FCO_NRO	Non-repudiation of origin	The TSF gives a recipient evidence that identifies the originator of information so that the originator cannot later den...
common-criteria-cc-2022::FCO_NRR	Non-repudiation of receipt	The TSF gives a sender evidence that information was received so that the recipient cannot later deny receiving it. Comp...

Class FCS: Cryptographic support – Common Criteria CC:2022

4 controls

Controls in the Class FCS: Cryptographic support – Common Criteria CC:2022 domain of Common Criteria CC:2022: 4 controls
Code	Title	Description
common-criteria-cc-2022::FCS_CKM	Cryptographic key management	Keys are managed across their whole life. Components: FCS_CKM.1 Cryptographic key generation, FCS_CKM.2 Cryptographic ke...
common-criteria-cc-2022::FCS_COP	Cryptographic operation	A cryptographic operation is carried out with a specified algorithm and a key of specified size, in line with a named st...
common-criteria-cc-2022::FCS_RBG	Random bit generation	The TSF generates random bits of defined quality. Components: FCS_RBG.1 Random bit generation (RBG) with entropy sources...
common-criteria-cc-2022::FCS_RNG	Generation of random numbers	The family sets quality requirements for random numbers meant for cryptographic use. One component: FCS_RNG.1 Random num...

Class FDP: User data protection – Common Criteria CC:2022

15 controls

Controls in the Class FDP: User data protection – Common Criteria CC:2022 domain of Common Criteria CC:2022: 15 controls
Code	Title	Description
common-criteria-cc-2022::FDP_ACC	Access control policy	The family names the access control security function policies (SFPs) and fixes the scope of each: the subjects, the obj...
common-criteria-cc-2022::FDP_ACF	Access control functions	The family states the rules by which the functions implementing an access control policy named under FDP_ACC decide acce...
common-criteria-cc-2022::FDP_DAU	Data authentication	An entity can vouch for the authenticity of a unit of data so that later readers can verify it was not forged or altered...
common-criteria-cc-2022::FDP_ETC	Export from the TOE	TSF-mediated export of user data out of the TOE, where the security attributes are either preserved with the data or del...
common-criteria-cc-2022::FDP_IFC	Information flow control policy	The family names the information flow control SFPs and fixes the scope of each: the subjects, the information and the op...
common-criteria-cc-2022::FDP_IFF	Information flow control functions	The family states the rules of the functions that implement an information flow policy, including the attributes used an...
common-criteria-cc-2022::FDP_IRC	Information retention control	New in CC:2022: the TSF manages data the TOE no longer needs for its operation but still holds, so that retained data is...
common-criteria-cc-2022::FDP_ITC	Import from outside of the TOE	TSF-mediated import of user data into the TOE with appropriate security attributes and protection: limits on what may be...
common-criteria-cc-2022::FDP_ITT	Internal TOE transfer	Protection of user data when it moves between separated parts of one TOE over an internal channel. Components: FDP_ITT.1...
common-criteria-cc-2022::FDP_RIP	Residual information protection	Data held in a resource is made unavailable when the resource is released from one object and reallocated to another, so...
common-criteria-cc-2022::FDP_ROL	Rollback	The TSF can undo the last operation or a bounded series of operations and go back to an earlier known-good state. Compon...
common-criteria-cc-2022::FDP_SDC	Stored data confidentiality	User data kept in memory areas the TSF protects stays confidential: the TSF gives access only through specified interfac...
common-criteria-cc-2022::FDP_SDI	Stored data integrity	User data stored in containers under TSF control is monitored for integrity errors, in memory or on storage devices, and...
common-criteria-cc-2022::FDP_UCT	Inter-TSF user data confidentiality transfer protection	User data exchanged with another trusted IT product over an external channel is kept from disclosure. One component: FDP...
common-criteria-cc-2022::FDP_UIT	Inter-TSF user data integrity transfer protection	User data travelling to or from another trusted IT product is protected against modification, deletion, insertion and re...

Class FIA: Identification and authentication – Common Criteria CC:2022

7 controls

Controls in the Class FIA: Identification and authentication – Common Criteria CC:2022 domain of Common Criteria CC:2022: 7 controls
Code	Title	Description
common-criteria-cc-2022::FIA_AFL	Authentication failures	The TSF counts unsuccessful authentication attempts and acts when a threshold is reached, with parameters such as the nu...
common-criteria-cc-2022::FIA_API	Authentication proof of identity	The TOE proves its own identity to an external entity in its environment so that the entity can verify it. One component...
common-criteria-cc-2022::FIA_ATD	User attribute definition	The TSF keeps, for each user, the security attributes beyond identity that it needs to enforce the SFRs, such as roles,...
common-criteria-cc-2022::FIA_SOS	Specification of secrets	The TSF enforces quality metrics on secrets supplied to it and can generate secrets that meet a metric. Components: FIA_...
common-criteria-cc-2022::FIA_UAU	User authentication	The family fixes the kinds of authentication the TSF supports and the attributes they rest on. Components: FIA_UAU.1 Tim...
common-criteria-cc-2022::FIA_UID	User identification	The family fixes when users must identify themselves before the TSF mediates any other action for them. Components: FIA_...
common-criteria-cc-2022::FIA_USB	User-subject binding	When an authenticated user activates a subject to act for them, the TSF associates the user's security attributes with t...

Class FMT: Security management – Common Criteria CC:2022

8 controls

Controls in the Class FMT: Security management – Common Criteria CC:2022 domain of Common Criteria CC:2022: 8 controls
Code	Title	Description
common-criteria-cc-2022::FMT_LIM	Limited capabilities and availability	Taken into Part 2 in CC:2022 from smart card practice: functions are designed so that their capabilities are limited and...
common-criteria-cc-2022::FMT_MOF	Management of functions in TSF	Authorised users control how TSF functions behave: determining behaviour, disabling, enabling or modifying a function is...
common-criteria-cc-2022::FMT_MSA	Management of security attributes	Authorised users control security attributes, including viewing and changing them, with secure values and defaults. Comp...
common-criteria-cc-2022::FMT_MTD	Management of TSF data	Authorised roles control TSF data such as audit settings, clock, authentication data and limits. Components: FMT_MTD.1 M...
common-criteria-cc-2022::FMT_REV	Revocation	Security attributes of users, subjects, objects or other entities can be revoked by authorised roles, and the rules fix...
common-criteria-cc-2022::FMT_SAE	Security attribute expiration	The TSF enforces time limits on the validity of security attributes and takes a defined action when an attribute expires...
common-criteria-cc-2022::FMT_SMF	Specification of management functions	The ST lists the management functions the TOE provides, through which administrators set the parameters that control sec...
common-criteria-cc-2022::FMT_SMR	Security management roles	The TSF maintains the roles that carry security management capabilities and associates users with them. Components: FMT_...

Class FPR: Privacy – Common Criteria CC:2022

4 controls

Controls in the Class FPR: Privacy – Common Criteria CC:2022 domain of Common Criteria CC:2022: 4 controls
Code	Title	Description
common-criteria-cc-2022::FPR_ANO	Anonymity	A user's identity stays undisclosed while they use a resource or service; the identity of the subject acting for them is...
common-criteria-cc-2022::FPR_PSE	Pseudonymity	A user's identity stays undisclosed while they use a resource or service, yet they remain accountable through an alias....
common-criteria-cc-2022::FPR_UNL	Unlinkability	Selected uses of resources or services by a user cannot be linked together by other parties, so that patterns of use can...
common-criteria-cc-2022::FPR_UNO	Unobservability	Others, third parties above all, cannot tell that a user is making use of a resource or service. Components: FPR_UNO.1 U...

Class FPT: Protection of the TSF – Common Criteria CC:2022

16 controls

Controls in the Class FPT: Protection of the TSF – Common Criteria CC:2022 domain of Common Criteria CC:2022: 16 controls
Code	Title	Description
common-criteria-cc-2022::FPT_EMS	TOE emanation	Taken into Part 2 in CC:2022: the TOE limits emanations (power consumption, timing, electromagnetic or other externally...
common-criteria-cc-2022::FPT_FLS	Fail secure	The TOE keeps enforcing its SFRs when identified kinds of failure occur in the TSF, by preserving a secure state. Single...
common-criteria-cc-2022::FPT_INI	TSF initialisation	Taken into Part 2 in CC:2022: a dedicated function brings the TSF up in a correct, secure operating state, verifying wha...
common-criteria-cc-2022::FPT_ITA	Availability of exported TSF data	TSF data exchanged with another trusted IT product remains available within a defined availability metric. One component...
common-criteria-cc-2022::FPT_ITC	Confidentiality of exported TSF data	TSF data on its way to or from another trusted IT product is shielded from unauthorised disclosure. One component: FPT_I...
common-criteria-cc-2022::FPT_ITI	Integrity of exported TSF data	TSF data on its way to or from another trusted IT product is shielded from unauthorised modification, with detection and...
common-criteria-cc-2022::FPT_ITT	Internal TOE TSF data transfer	TSF data moving between separate parts of the TOE over an internal channel is protected. Components: FPT_ITT.1 Basic int...
common-criteria-cc-2022::FPT_PHP	TSF physical protection	The TSF is protected against unauthorised physical access, and against physical tampering, interference and substitution...
common-criteria-cc-2022::FPT_RCV	Trusted recovery	The TSF can tell that the TOE has started without its protection being compromised and can recover after a discontinuity...
common-criteria-cc-2022::FPT_RPL	Replay detection	The TSF detects replay of listed entities such as messages, service requests or responses and takes a defined action, wh...
common-criteria-cc-2022::FPT_SSP	State synchrony protocol	In a distributed TOE, parts of the TOE confirm to each other that an action has been received so that state stays consis...
common-criteria-cc-2022::FPT_STM	Time stamps	The TSF provides reliable time stamps, and CC:2022 adds a component on the source of time. Components: FPT_STM.1 Reliabl...
common-criteria-cc-2022::FPT_TDC	Inter-TSF TSF data consistency	When TSF data such as attributes is shared with another trusted IT product, both sides interpret it consistently. One co...
common-criteria-cc-2022::FPT_TEE	Testing of external entities	The TSF tests external entities (applications, underlying platforms, hardware or other boxes, but not human users) at de...
common-criteria-cc-2022::FPT_TRC	Internal TOE TSF data replication consistency	TSF data replicated inside a distributed TOE stays consistent, with re-synchronisation when an internal channel is resto...
common-criteria-cc-2022::FPT_TST	TSF self-test	The TSF tests its own correct operation (at start-up, periodically, on request or on conditions) and verifies the integr...

Class FRU: Resource utilisation – Common Criteria CC:2022

3 controls

Controls in the Class FRU: Resource utilisation – Common Criteria CC:2022 domain of Common Criteria CC:2022: 3 controls
Code	Title	Description
common-criteria-cc-2022::FRU_FLT	Fault tolerance	The TOE keeps operating correctly despite listed failures, either for a defined subset of capabilities or for all. Compo...
common-criteria-cc-2022::FRU_PRS	Priority of service	The TSF controls resource use so that high-priority activities under its control are completed without undue interferenc...
common-criteria-cc-2022::FRU_RSA	Resource allocation	The TSF limits resource use by users and subjects so that nobody can cause denial of service by monopolising resources....

Class FTA: TOE access – Common Criteria CC:2022

6 controls

Controls in the Class FTA: TOE access – Common Criteria CC:2022 domain of Common Criteria CC:2022: 6 controls
Code	Title	Description
common-criteria-cc-2022::FTA_LSA	Limitation on scope of selectable attributes	The TSF narrows which session security attributes a user is allowed to pick, by rules such as time, location or method o...
common-criteria-cc-2022::FTA_MCS	Limitation on multiple concurrent sessions	The TSF limits how many sessions the same user may hold at once. Components: FTA_MCS.1 Basic limitation on multiple conc...
common-criteria-cc-2022::FTA_SSL	Session locking and termination	The TSF can lock, unlock and terminate interactive sessions, on its own initiative after inactivity or on the user's req...
common-criteria-cc-2022::FTA_TAB	TOE access banners	The TSF shows a configurable advisory warning about appropriate use of the TOE before a session is established. One comp...
common-criteria-cc-2022::FTA_TAH	TOE access history	On successful session establishment the TSF shows the user the record of successful and failed attempts on their account...
common-criteria-cc-2022::FTA_TSE	TOE session establishment	The TSF can refuse to let a user establish a session, based on attributes such as location, time or method of access. On...

Class FTP: Trusted path and channels – Common Criteria CC:2022

3 controls

Controls in the Class FTP: Trusted path and channels – Common Criteria CC:2022 domain of Common Criteria CC:2022: 3 controls
Code	Title	Description
common-criteria-cc-2022::FTP_ITC	Inter-TSF trusted channel	A trusted channel to another trusted IT product is logically distinct from other channels, gives each end assurance of t...
common-criteria-cc-2022::FTP_PRO	Trusted channel protocol	New in CC:2022: the family specifies how a trusted channel is established and used to carry TSF or user data securely, s...
common-criteria-cc-2022::FTP_TRP	Trusted path	A trusted path linking users with the TSF, logically distinct from other paths, with each end assured of the other's ide...

What is Common Criteria CC:2022 and who does it apply to?

Common Criteria CC:2022 is a compliance framework from International (CCRA member schemes) with 11 domains and 74 controls. The Common Criteria's catalogue of security functional requirements for IT products, CC:2022: 74 functional families across security audit, communication, cryptography, user data protection, identification and authentication, security management, privacy, protection of the security functionality, resource use, access and trusted channels, with Part 1's evaluation model as the frame. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Common Criteria CC:2022 actually require?

Common Criteria CC:2022 has 74 controls organised across 11 domains. The largest domains are Class FPT: Protection of the TSF – Common Criteria CC:2022 (16 controls), Class FDP: User data protection – Common Criteria CC:2022 (15 controls), Class FMT: Security management – Common Criteria CC:2022 (8 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Common Criteria CC:2022 do I already cover?

Common Criteria CC:2022 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement Common Criteria CC:2022?

Start your Common Criteria CC:2022 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Common Criteria CC:2022 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 74 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.

Get Started Free →

Free forever, no credit card required