CCN: Spain's Common Criteria Scheme
CCN, the Centro Criptológico Nacional (National Cryptologic Centre), is Spain’s national Common Criteria certification body. It is operated under the Centro Nacional de Inteligencia (CNI), Spain’s national intelligence service, and is a long-standing CCRA authorizing scheme.
Key facts
- Authorizing body: Centro Criptológico Nacional (CCN), under the Centro Nacional de Inteligencia (CNI)
- Country / region: Spain
- Year established: CCN has operated Spain’s national CC scheme since the early 2000s
- Product types: smart cards and ICs, network devices, eID components, cryptographic products, software security products
- CCRA status: Certificate Authorizing Member; historically a SOG-IS authorizing member; designated EUCC certification authority in Spain
- Canonical portal: https://oc.ccn.cni.es/
Overview
CCN’s certification body, sometimes referenced as OC-CCN (Organismo de Certificación), issues Spanish CC certificates and publishes the supporting evaluation reports. Spain participated in SOG-IS, the European mutual recognition framework that preceded EUCC, including high-assurance smart card and embedded evaluations.
How evaluations work under this scheme
Evaluations are carried out by accredited Spanish ITSEFs (laboratorios de evaluación de la seguridad de las tecnologías de la información). The lab produces an evaluation report which CCN reviews and uses to issue the final certification under the Spanish national CC scheme. See also ITSEF.
Notable product categories
- Smart cards and embedded secure elements
- eID components and cryptographic products
- Network and security products
- Components used in Spanish government and public-sector systems
Relationship to CC baseline
CCN evaluations follow ISO/IEC 15408 and CC:2022. Spain participates in EUCC implementation across the EU and continues to issue national CC certificates under CCRA.
Where to find official records
See also: What is Common Criteria?, EAL Levels, Protection Profiles, Glossary.
Frequently asked questions
What is CCN?
CCN is the Centro Criptológico Nacional, Spain's National Cryptologic Centre. It operates under the Centro Nacional de Inteligencia (CNI), Spain's national intelligence service, and runs the country's Common Criteria certification scheme. The certification body is sometimes referenced as OC-CCN (Organismo de Certificación) and has operated Spain's national CC scheme since the early 2000s.
What does CCN certify?
CCN issues Common Criteria certificates for smart cards and integrated circuits, network devices, eID components, cryptographic products, and software security products. The scheme places particular emphasis on components used in Spanish government and public-sector systems, and CCN maintains the STIC catalogue of products approved for use by Spanish public administration.
How is a CCN certificate issued?
Evaluations are carried out by accredited Spanish ITSEFs (laboratorios de evaluación de la seguridad de las tecnologías de la información). The lab produces an evaluation report against the claimed Security Target, following the Common Evaluation Methodology. CCN reviews the report and issues the certification under the Spanish national CC scheme. Certificates are published on the OC-CCN portal and mirrored on the CCRA portal.
Is CCN a CCRA member?
Yes. CCN is a CCRA Certificate Authorizing Member, and Spain was historically a SOG-IS authorizing member as well. CCN is now a designated EUCC certification authority in Spain under the EU Cybersecurity Act. Certificates issued by CCN are recognised across CCRA member nations and form part of EUCC implementation across the EU.
What is the STIC catalogue?
STIC is the Catálogo de Productos y Servicios de Seguridad de las Tecnologías de la Información y la Comunicación, Spain's national catalogue of approved security products. CCN maintains it as part of its national role beyond pure Common Criteria certification. Inclusion in STIC is a reference for procurement by Spanish government, defence, and critical-infrastructure operators, and often builds on a CC certificate as the underlying technical evidence.
How long is a CCN certificate valid?
Common Criteria certificates do not have a fixed CCRA-wide validity period. CCN certificates remain on the active product list until the underlying product is withdrawn, changes materially without a maintenance update, or moves to an archive list because the evaluation evidence has aged. Vendors typically refresh certificates through assurance continuity (impact analysis reports) or by re-evaluating the product against the current standard.