SoK: Failure Modes in Common Criteria Product Evaluation - a Taxonomy and Design-For-Evaluability Guidance

The Common Criteria CC; ISO/IEC 15408 is the principal international framework for evaluating the security of IT products, and its certificates gate procurement across government, defense, and regulated industry. Yet evaluations routinely stall, fail, or yield certificates whose assurances do not...