SERTIT: Norway's Common Criteria Scheme
SERTIT, the Norwegian Certification Authority for IT Security, is Norway’s national Common Criteria certification body. It is operated by the Norwegian National Security Authority (NSM) and is a CCRA authorizing member.
Key facts
- Authorizing body: SERTIT, operated under the Norwegian National Security Authority (NSM)
- Country / region: Norway
- Year established: SERTIT has been operating as Norway’s certification authority since the early 2000s
- Product types: network and communications products, public-sector IT, identity and access products, smart card-related TOEs
- CCRA status: Certificate Authorizing Member
- Canonical portal: https://sertit.no/
Overview
SERTIT is a smaller scheme than BSI or ANSSI in absolute volume, but it is an established CCRA authorizing member and issues certificates for vendors that serve Nordic and European markets. Its output concentrates in communications equipment, identity products, and TOEs tied to public-sector use cases.
How evaluations work under this scheme
A vendor contracts with a SERTIT-accredited ITSEF. The ITSEF executes the CEM work units and any applicable Supporting Documents, producing the Evaluation Technical Report. SERTIT reviews the ETR and issues the Certification Report and certificate. Certificates are published on SERTIT’s site and mirrored via the CCRA portal.
Notable product categories
- Secure communications and network products
- Identity, access, and authentication components
- Public-sector IT systems and applications
- Smart card-related TOEs in selected programmes
Relationship to CC baseline
SERTIT evaluations follow ISO/IEC 15408 and the CEM baseline. The scheme participates in CCRA-level coordination and accepts cPP-driven evaluations produced by its labs, with certificates recognized by other authorizing and consuming members up to the CCRA cap.
Where to find official records
See also: Certification Schemes Overview, EAL Levels, Glossary.
Frequently asked questions
What is SERTIT?
SERTIT is the Norwegian Certification Authority for IT Security, Norway's national Common Criteria certification body. It is operated by the Norwegian National Security Authority (NSM) and has been operating as Norway's certification authority since the early 2000s. SERTIT is a CCRA Certificate Authorizing Member.
What does SERTIT certify?
SERTIT issues Common Criteria certificates concentrated in a few areas: secure communications and network products, identity, access, and authentication components, public-sector IT systems and applications, and smart card-related TOEs in selected programmes. The scheme is smaller than BSI or ANSSI in absolute volume but serves vendors that supply Nordic and European markets, particularly defence and government use cases.
How is a SERTIT certificate issued?
A vendor contracts with a SERTIT-accredited ITSEF. The ITSEF executes the Common Evaluation Methodology work units and any applicable Supporting Documents, producing the Evaluation Technical Report. SERTIT reviews the ETR and issues the Certification Report and certificate. Certificates are published on SERTIT's site at sertit.no and mirrored via the CCRA portal for international recognition.
Is SERTIT a CCRA member?
Yes. SERTIT is a CCRA Certificate Authorizing Member, so certificates it issues are recognised by all other CCRA member nations up to the standard cap (EAL2 for arbitrary evaluations, higher for products conforming to a collaborative Protection Profile). SERTIT participates in CCRA-level coordination and accepts cPP-driven evaluations produced by its labs.
Why would a vendor choose SERTIT?
Vendors typically route through SERTIT when they have a Norwegian or Nordic procurement context, where domestic certification is preferred or required for public-sector and defence customers. SERTIT is also a viable choice for smaller-scale evaluations where the lab relationships and faster scheme communications outweigh the volume advantage of larger schemes. The technical methodology is the same as in any CCRA scheme.
How does SERTIT relate to other Nordic schemes?
SERTIT is one of several smaller European CCRA schemes, with Sweden's CSEC as the other Nordic CC scheme. Norway is not an EU member state, so SERTIT is not currently a designated EUCC certification authority in the way that Swedish, Danish, Finnish, and other EU schemes are. CCRA mutual recognition still applies, and Norwegian certificates remain accepted by EU schemes via the CCRA route.