What does the security certification phase involve, and what are its typical pitfalls?

Get the certifications the target markets require or want. The steps are to select a certification partner, create the deliverables, run a pre-audit and close the gaps, request certification, and pass the audit. The pitfalls are retrofitting, special environments and underestimating stringency.

It needs management commitment, a compliant development process, security management, security experts and a security culture. Outputs are the certification deliverables, a gap analysis, the certificate, and the CE declaration of conformity where the CRA applies.

Good practice: choose the certification partner wisely, bring external experts on board, and get multiple opinions. The pitfalls:

• Retrofitting: trying to certify a product that wasn't developed for it. Certifiers check the process evidence (requirements, traceability, test reports), which can't be made up afterwards.
• Building "special" environments that pass the audit but aren't what ships.
• Underestimating stringency: the effort and time are usually larger than planned.

Go deeper:

• Common Criteria portal — protection profiles and certified products
• ENISA — EUCC certification scheme — the EU scheme built on Common Criteria