Certification

The Certification Body certifies the security of IT products and systems in accordance with the procedure specified in Fifth Title of the IT security evaluation and certification regulations, taking into account, amongst other evidences, the evaluation technical reports issued by the laboratories, and in accordance with the evaluation standards, criteria and methodology listed in Sixth Title.

The security certification of a product means the recognition of the fulfilment of the security properties specified in its Security Target.

The security certification of a product does not, however, mean or imply fitness for purpose under any particular scenario o environment of usage. To determine the applicability of certification results under the product intended environment, the user should check the Security Target.

Once granted a certificate, it is valid until revoked, which happens with changes on the conditions or factors affecting the certificate, such as technological advances, appearance of new vulnerabilities, not fulfilment of the conditions to use the certificate, changes in the product, or explicit denial of the certificate requester. To ensure that current certificates are up to date, the Certification Body performs routine inspections, audits and analysis on the certified products, their intended environment and the usage of the certificates themselves.