CCN - Spain's Common Criteria Scheme

CCN, the Centro Criptológico Nacional (National Cryptologic Centre), is Spain’s national Common Criteria certification body. It is operated under the Centro Nacional de Inteligencia (CNI), Spain’s national intelligence service, and is a long-standing CCRA authorizing scheme.

Key facts

  • Authorizing body: Centro Criptológico Nacional (CCN), under the Centro Nacional de Inteligencia (CNI)
  • Country / region: Spain
  • Year established: CCN has operated Spain’s national CC scheme since the early 2000s
  • Product types: smart cards and ICs, network devices, eID components, cryptographic products, software security products
  • CCRA status: Certificate Authorizing Member; historically a SOG-IS authorizing member; designated EUCC certification authority in Spain
  • Canonical portal: https://oc.ccn.cni.es/

Overview

CCN’s certification body, sometimes referenced as OC-CCN (Organismo de Certificación), issues Spanish CC certificates and publishes the supporting evaluation reports. Spain participated in SOG-IS, the European mutual recognition framework that preceded EUCC, including high-assurance smart card and embedded evaluations.

How evaluations work under this scheme

Evaluations are carried out by accredited Spanish ITSEFs (laboratorios de evaluación de la seguridad de las tecnologías de la información). The lab produces an evaluation report which CCN reviews and uses to issue the final certification under the Spanish national CC scheme. See also ITSEF.

Notable product categories

  • Smart cards and embedded secure elements
  • eID components and cryptographic products
  • Network and security products
  • Components used in Spanish government and public-sector systems

Relationship to CC baseline

CCN evaluations follow ISO/IEC 15408 and CC:2022. Spain participates in EUCC implementation across the EU and continues to issue national CC certificates under CCRA.

Where to find official records

See also: What is Common Criteria?, EAL Levels, Protection Profiles, Glossary.

  • BSI - Germany's Common Criteria SchemeBSI (Bundesamt für Sicherheit in der Informationstechnik) is Germany's Common Criteria certification body and one of the largest authorizing schemes under the CCRA.
  • ANSSI - France's Common Criteria SchemeANSSI (Agence nationale de la sécurité des systèmes d'information) operates France's national CC scheme and is a major issuer of high-assurance smart card and embedded certificates.
  • NIAP - The U.S. Common Criteria SchemeNIAP (National Information Assurance Partnership) runs the U.S. Common Criteria scheme and mandates exact-conformance evaluations against approved Protection Profiles.
  • CCCS - Canada's Common Criteria SchemeThe Canadian Centre for Cyber Security (CCCS) operates Canada's CC scheme, emphasising collaborative Protection Profile evaluations and Technical Community participation.