From Common Criteria to SESIP, from IEC 62443 to SecNumCloud — explore the standards and schemes Internet of Trust supports, grouped by domain, with the value we bring at each step.
General Purpose
01
The international reference for high-assurance security evaluation.
Common Criteria (ISO/IEC 15408) is the international framework for evaluating the security of IT products against defined Security Targets, Protection Profiles and assurance levels. EUCC is the European cybersecurity certification scheme based on Common Criteria, adopted under the EU Cybersecurity Act to provide harmonised, mutually recognised certification across the EU.
02
NIST standard for validating cryptographic modules.
FIPS 140-3, operated by NIST through the Cryptographic Module Validation Program (CMVP) and aligned with ISO/IEC 19790, defines security requirements for cryptographic modules. Validation is required for products handling sensitive information in US federal agencies and widely expected by regulated, financial and cloud customers worldwide.
03
Fixed-time Common Criteria evaluation methodology.
FITCEM is a security evaluation methodology used to support certification of products in alignment with Common Criteria and EUCC-related expectations. It is designed to bring predictability to evaluation effort while preserving rigour for connected and embedded products. Detailed scope and naming should be confirmed with the certification body for each engagement.
04
France’s first-level security certification from ANSSI.
Certification de Sécurité de Premier Niveau (CSPN) is a first-level security certification operated by ANSSI. It provides a focused, time-boxed evaluation of IT products, often used when a shorter and more targeted assessment is required compared with a full Common Criteria evaluation.
05
GlobalPlatform methodology for scalable IoT security evaluation.
SESIP, developed by GlobalPlatform, is a scalable security evaluation methodology for connected devices, IoT components, platforms and embedded systems. It supports composition, allowing platform certificates to be reused by product makers and aligning well with the CRA, RED and EUCC ecosystem.
Consumer & Industrial
01
Cybersecurity for industrial automation and control systems.
The IEC 62443 series is the main cybersecurity standard for industrial automation and control systems (IACS). It applies to component vendors, system integrators and asset owners across OT environments, energy, manufacturing, transport and other connected infrastructure.
02
Baseline cybersecurity for consumer IoT devices.
ETSI EN 303 645 defines a baseline of 13 provisions for consumer IoT cybersecurity — no default passwords, vulnerability disclosure, software updates, secure communication and more. It is a foundation for RED Article 3(3) and CRA Class I conformity.
03
Cybersecurity engineering for road vehicles.
ISO/IEC 21434 defines cybersecurity engineering requirements for the entire lifecycle of automotive E/E systems. Combined with UN R155, it is the reference for vehicle type-approval cybersecurity worldwide.
Finance & Payment
01
Security, evaluation and interoperability for payment technologies.
EMVCo defines security, evaluation and interoperability requirements for payment technologies including payment cards, terminals, mobile payments, tokenization, payment acceptance and secure components. EMVCo product approval and security evaluation processes are widely used by the payment industry to demonstrate trust across the ecosystem.
02
European card payment security and ecosystem assurance.
CPACE relates to European card payment security, authentication and payment ecosystem assurance, developed in the context of the European Card Payment Cooperation (ECPC). It targets harmonisation across European card payment schemes.
Cloud & Connectivity
01
France’s high-trust qualification for cloud service providers.
SecNumCloud is the ANSSI qualification scheme for cloud service providers handling sensitive data. It combines technical, organisational and legal protections, including immunity to extra-EU laws — a strong reference for EUCS High and sovereign-cloud strategies.
02
Security assurance for 5G network equipment and operators.
3GPP defines 5G security architecture (TS 33.501) and Security Assurance Specifications (SCAS) per network function. GSMA NESAS provides the audit and product-evaluation framework used by operators and regulators worldwide.
We’ll send you access by email.
