Your own certificate
Status changes (active, in maintenance, archived, withdrawn), Security Target republications, Maintenance Reports, and Certification Report updates - on every certificate where your product is the TOE.
Use case - Vendor certification program
Stop missing the silent maintenance update on your own certificate.
Common Criteria certificates do not sit still. Schemes republish Security Targets, issue Maintenance Reports, and flip statuses without sending an email. If your product is in the field under an EAL4+ certification today, the document set on commoncriteriaportal.org or your national scheme portal will change a handful of times before it expires - and almost every vendor finds out at the next surveillance audit, not the day it happens.
NenkinTracker watches your certificate and the components you reused every day, and emails you the moment BSI, ANSSI, NIAP, EUCC, SESIP, or any scheme republishes a document or changes a status. From 49.90 EUR/month on the Professional plan, with a 30-day free trial.
What we watch for vendor cert programs
The components you reused
If your product builds on a certified platform - smart card OS, secure element, HSM, TPM - we watch those underlying certs too. A status flip on a dependency lands in your inbox, not in next year's audit.
CVEs against the TOE
NVD entries linked to your certified product, as they publish. CVSS, affected versions, and remediation status, attached to the certificate they impact.
What gets caught
Five categories of change cover almost every signal a vendor cert-program manager needs to act on. NenkinTracker emits one notification per change, attributed to the document and scheme that produced it.
- Maintenance Reports
- Schemes routinely republish maintenance documents to record evaluator-confirmed updates. Easy to miss if you only check the portal at renewal time.
- Security Target revisions
- ST documents get re-uploaded silently when typos, scope clarifications, or composition updates land. The hash changes, the URL often does not.
- Status flips
- Active → maintenance, maintenance → archived, archived → withdrawn. Each flip changes what you can claim in an RFP and what an auditor will accept.
- Certification Report updates
- Reissued CRs typically signal a substantive evaluator finding. We diff the document version and surface what changed.
- EUCC transition events
- National CC certificates moving to EUCC under the EU Cybersecurity Act. Affects whether your product is on the fast lane for CRA conformity.
Vendor-sized portfolio, vendor-sized price.
The Professional plan at 49.90 EUR/month covers up to 50 followed products across 10 lists - enough to track your full product line plus the certified components you reused. Larger portfolios scale up to Enterprise (unlimited products, plus developer-level vendor signals) at 249.90 EUR/month.
The 30-day free trial gives every paid feature - no credit card required - so you can prove the workflow on your own certificates before you commit.
Built by people who help write the standard
NenkinTracker is built by Nenkin Technologies AS, a Norwegian Common Criteria company. Our co-founder Kjartan Kvassness Jæger spent six years as Technical Manager at the Norwegian national security authority and has represented Norway on the Common Criteria Development Board, the SOG-IS Joint Interpretation Working Group, and ISO/IEC JTC1 SC 27 / WG3 for more than twenty years. Co-founder Lauritz Prag Sømme led the threat-modelling framework at DNB Bank as security architect and consults on secure systems for the Norwegian Defence Materiel Agency. The "silent revisions" problem this page is about is one we lived firsthand chasing document churn across scheme portals.
Frequently asked questions
- How do I track my own product's Common Criteria certificate?
- Sign in to NenkinTracker, search for your product by name or vendor, and follow it. Any change to its certifications - status, documents, linked CVEs - triggers an email and an in-app notification. The Professional plan at 49.90 EUR/month covers a vendor-sized portfolio (up to 50 followed products and 10 lists). The 30-day free trial includes the same access.
- What schemes does NenkinTracker monitor for maintenance updates?
- Every CCRA national scheme (BSI, ANSSI, NIAP, CCCS, SERTIT, JISEC, KCMVP, OCSI, CCN), the EUCC scheme under the EU Cybersecurity Act, SESIP, PSA Certified, EMVCo, MIFARE, and ESA. Document changes are confirmed daily by our team to catch silent revisions where the URL stays the same but the file content changes.
- Can I track the certified components I built my product on?
- Yes. Add the underlying certificates to the same list as your own product and you will receive notifications when any of them change status, get a Maintenance Report, or have a CVE linked. This is the workflow most vendor cert-program managers run when a composition (e.g. a smart card OS on a certified secure element) is in scope.
Catch the next maintenance update on your own certificate.
Start the 30-day free trial and follow your own products in five minutes. Or book 20 minutes with a founder if you would rather walk through the workflow with us first.