Your own certificate
Status changes (active, in maintenance, archived, withdrawn), Security Target republications, Maintenance Reports, and Certification Report updates on every certificate where your product is the TOE.
Use case: Vendor certification program
Stop missing the silent maintenance update on your own certificate.
Common Criteria certificates do not sit still. Schemes republish Security Targets, issue Maintenance Reports, and flip statuses without sending an email. If your product is in the field under an EAL4+ certification today, the document set on commoncriteriaportal.org or your national scheme portal will change a handful of times before it expires, and almost every vendor finds out at the next surveillance audit, not the day it happens.
NenkinTracker watches your certificate and the components you reused every day, and emails you the moment BSI, ANSSI, NIAP, EUCC, SESIP, or any scheme republishes a document or changes a status. From €99/month on the Professional plan, excluding VAT, with a 30-day free trial.
What we watch for vendor cert programs
The components you reused
If your product builds on a certified platform (smart card OS, secure element, HSM, TPM) we watch those underlying certs too. A status flip on a dependency lands in your inbox, not in next year's audit.
CVEs against the TOE
NVD entries linked to your certified product, as they publish. CVSS, affected versions, and remediation status, attached to the certificate they impact.
What gets caught
Five categories of change cover almost every signal a vendor cert-program manager needs to act on. NenkinTracker emits one notification per change, attributed to the document and scheme that produced it.
- Maintenance Reports
- Schemes routinely republish maintenance documents to record evaluator-confirmed updates. Easy to miss if you only check the portal at renewal time.
- Security Target revisions
- ST documents get re-uploaded silently when typos, scope clarifications, or composition updates land. The hash changes, the URL often does not.
- Status flips
- Active → maintenance, maintenance → archived, archived → withdrawn. Each flip changes what you can claim in an RFP and what an auditor will accept.
- Certification Report updates
- Reissued CRs typically signal a substantive evaluator finding. We diff the document version and surface what changed.
- EUCC transition events
- National CC certificates moving to EUCC under the EU Cybersecurity Act. Affects whether your product is on the fast lane for CRA conformity.
Watch the pipeline behind your competitors' next move
Certification bodies publish their "Products in Evaluation" lists in plain sight. The list shows which vendor filed at which lab, against which assurance package, at roughly what time. NenkinTracker ingests every one of these lists across BSI, NIAP, CCCS, JISEC, CSEC Sweden, TrustCB, Brightsight, and the equivalents, so a cert-program manager can read what was previously reconstructed from rumour.
Three uses come up routinely. Roadmap timing: a direct competitor that entered evaluation eight months ago at a lab with a twelve-month average cycle is probably four months from an announcement, which is a useful input to your own release decisions. Lab capacity: a target lab currently running several large evaluations is unlikely to start a new engagement quickly, regardless of what the lab's marketing-side responsiveness suggests. Cross-scheme positioning: a competitor that quietly enters a second scheme is signalling a regional or sector expansion before it shows up in the certified catalogue. The pattern is written up in Procurement Planning Before the Certificate Exists.
Vendor-sized portfolio, vendor-sized price.
The Professional plan at €99/month covers up to 100 followed products across 10 lists. Team at €299/month adds unlimited lists and products, evaluation tracking, and following up to 3 developers. Enterprise at €499/month adds unlimited developer following, certification-source feeds, and custom notifications. Prices exclude VAT and additional users.
The 30-day free trial includes Enterprise features with no credit card required, so you can prove the workflow on your own certificates before you commit.
Built by people who help write the standard
NenkinTracker is built by Nenkin Technologies AS, a Norwegian Common Criteria company. Our co-founder Kjartan Kvassness Jæger spent six years as Technical Manager at the Norwegian national security authority and has represented Norway on the Common Criteria Development Board, the SOG-IS Joint Interpretation Working Group, and ISO/IEC JTC1 SC 27 / WG3 for more than twenty years. Co-founder Lauritz Prag Sømme led the threat-modelling framework at DNB Bank as security architect and consults on secure systems for the Norwegian Defence Materiel Agency. The "silent revisions" problem this page is about is one we lived firsthand chasing document churn across scheme portals.
Frequently asked questions
- How do I track my own product's Common Criteria certificate?
- Sign in to NenkinTracker, search for your product by name or vendor, and follow it. Changes to its certifications, documents, and linked CVEs trigger email and in-app notifications. Professional costs €99/month excluding VAT and covers up to 100 followed products across 10 lists. The 30-day free trial includes Enterprise features.
- What schemes does NenkinTracker monitor for maintenance updates?
- Every CCRA national scheme (BSI, ANSSI, NIAP, CCCS, SERTIT, JISEC, KCMVP, OCSI, CCN), the EUCC scheme under the EU Cybersecurity Act, SESIP, PSA Certified, EMVCo, MIFARE, and ESA. Document changes are confirmed daily by our team to catch silent revisions where the URL stays the same but the file content changes.
- Can I track the certified components I built my product on?
- Yes. Add the underlying certificates to the same list as your own product and you will receive notifications when any of them change status, get a Maintenance Report, or have a CVE linked. This is the workflow most vendor cert-program managers run when a composition (e.g. a smart card OS on a certified secure element) is in scope.
- Can NenkinTracker show which competitors are currently in evaluation, and where?
- Yes. Every certification body that publishes a 'Products in Evaluation' list (BSI, NIAP, CCCS, JISEC, CSEC Sweden, TrustCB, Brightsight, and the equivalents) is ingested daily. Search returns under-evaluation products with an 'Under Eval' badge, and a filter chip restricts the catalogue to that subset. Subscribe to a scheme to be alerted when a new product enters evaluation, or follow a specific under-evaluation product to be alerted when it is registered and again when its certificate issues. The full pattern for using pipeline data as competitive intelligence is in our blog post on procurement planning before the certificate exists.
Catch the next maintenance update on your own certificate.
Start the 30-day free trial and follow your own products in five minutes. Or book 30 minutes with a founder if you would rather walk through the workflow with us first.