Skip to content
Nenkin
Sign inStart free trial

EAL1: Functionally Tested

EAL1 is the entry assurance level of Common Criteria (ISO/IEC 15408-3). It provides independent confirmation that a Target of Evaluation (TOE) behaves as its documentation describes, based on minimal developer evidence.

Explore NenkinTracker to find certified products and compare their assurance levels, including EAL1.

Key facts

  • Assurance families covered: ADV_FSP.1 (basic functional specification), AGD_OPE.1 / AGD_PRE.1 (guidance and preparative procedures), ALC_CMC.1 / ALC_CMS.1 (configuration list), ATE_IND.1 (independent testing), AVA_VAN.1 (basic vulnerability survey).
  • Typical product categories: low-risk commodity software and components, internal tooling, products where the operational environment carries most of the trust.
  • Relative cost/time: the cheapest and fastest CC level; typically a few months of evaluation effort.
  • Attack potential resisted: Basic attacker with public information.

What this level tests

Evaluators confirm that the TOE performs as stated in its Security Target, check the vendor-supplied guidance, and run a baseline independent test. The AVA_VAN.1 vulnerability survey is limited to public-domain sources; evaluators look for known issues rather than performing new penetration testing.

There is no requirement to review design or source code. The developer provides a functional specification and a basic configuration list; nothing about the internal structure of the TOE is examined.

Typical product categories

EAL1 is uncommon for commercial security products because most procurement requirements ask for at least EAL2. It is occasionally seen for auxiliary software distributed alongside higher-assured components, for products in early programmes where a baseline certificate is sufficient, and for items evaluated only to demonstrate conformance to a minimal Protection Profile.

Common misconceptions

EAL is an assurance level, not a security-strength rating. EAL1 does not mean “a little secure.” It means the evaluator performed a shallow review. A TOE at EAL1 with strong design can be genuinely secure; a TOE at EAL1 with weak design may not be. The certificate attests only that the TOE does what the vendor says it does, to the limited depth of EAL1.

Comparison to adjacent levels

  • vs. EAL2: EAL2 adds a high-level design review (ADV_TDS.1), independent vulnerability analysis beyond a public survey (AVA_VAN.2), and stronger configuration management. Evaluator testing covers a subset of the TSF (ATE_COV.1, ATE_FUN.1); depth of testing (ATE_DPT.1) first appears at EAL3, so neither EAL1 nor EAL2 requires it.
  • vs. no certification: EAL1 still demands an independently written Evaluation Technical Report and a published Certification Report, useful when a customer needs any third-party attestation.

See the EAL Levels overview for the full comparison table, or the glossary for the underlying SAR vocabulary.

Frequently asked questions

What is EAL1?
EAL1 is the lowest Evaluation Assurance Level under Common Criteria (ISO/IEC 15408-3). It provides independent confirmation that a Target of Evaluation behaves as its documentation describes, based on minimal developer evidence. Evaluators check the functional specification, run a baseline independent test, and survey public sources for known vulnerabilities. There is no design or source-code review. Attack potential resisted is Basic.
When is EAL1 enough?
EAL1 is appropriate when threats are low and the user already has reasonable trust in the vendor, but still wants third-party attestation that the product does what it claims. Typical contexts include low-risk commodity software, internal tooling, products where the operational environment carries most of the trust, and auxiliary components shipped alongside higher-assured TOEs. Most commercial procurement requires at least EAL2.
Why is EAL1 rarely seen in commercial products?
Most procurement requirements specify EAL2 or higher because EAL2 is the cap for automatic CCRA mutual recognition outside collaborative Protection Profiles, while EAL1 is recognised mainly within the issuing scheme. Vendors who invest in any formal CC evaluation usually target EAL2 to gain international recognition for similar effort. EAL1 persists mostly for baseline conformance to minimal Protection Profiles.
How does EAL1 differ from EAL2?
EAL2 adds a security architecture description (ADV_ARC.1) and a basic TOE design review (ADV_TDS.1), upgrades vulnerability analysis from a public survey to evaluator-driven penetration testing (AVA_VAN.2), and tightens configuration management and delivery procedures. EAL1 examines only what the functional specification claims; EAL2 looks at how the product is built at a high level and tests for vulnerabilities against that design.
Does EAL1 mean the product is insecure?
No. EAL is an evaluation depth, not a security score. An EAL1 certificate attests that the evaluator performed a shallow review and confirmed the product behaves as documented. A well-designed product evaluated at EAL1 can be genuinely secure; a poorly designed one evaluated at EAL1 may not be. The certificate tells you what was checked, not what was proven beyond that check.
Is EAL1 recognised internationally under CCRA?
Yes. CCRA mutual recognition for non-cPP evaluations covers assurance up to EAL2 plus ALC_FLR augmentation, so EAL1 certificates are recognised across all CCRA member states. The narrower issue is market acceptance: most government and enterprise buyers ask for EAL2 or a Protection Profile, so the practical value of an EAL1 certificate often depends on whether your specific procurement explicitly accepts it.
  • EAL2: Structurally TestedEAL2 is the workhorse Common Criteria assurance level: a high-level design review with independent vulnerability analysis, and the CCRA mutual-recognition cap for non-cPP evaluations.
  • EAL3: Methodically Tested and CheckedEAL3 extends EAL2 with development environment security controls, systematic life-cycle definition, and deeper test coverage. Less common than EAL2 or EAL4 in practice.
  • EAL4: Methodically Designed, Tested, and ReviewedEAL4 is the highest assurance level generally achievable on commercial products without re-engineering for assurance. Standard for smart cards, HSMs, and many government-used products.
  • EAL5: Semiformally Designed and TestedEAL5 introduces semiformal design notation, well-structured internals, and modular-design test depth. Typical for smart card ICs and high-assurance OS kernels.