← Frameworks / Common Criteria / Control Mappings

Machine-readable: JSON API guide

Common Criteria for IT Security Evaluation (ISO/IEC 15408)

International standard for IT security evaluation defining Security Functional Requirements (SFRs) across 11 classes and Security Assurance Requirements (SARs) at 7 Evaluation Assurance Levels (EAL 1-7). Used for product certification through Protection Profiles and Security Targets evaluated by Common Criteria Testing Laboratories. Mutual recognition under the CCRA arrangement across 31 member nations.

Controls: 98
Total Mappings: 120
Publisher: CCRA (Common Criteria Recognition Arrangement) Version: 3.1 R5 (ISO/IEC 15408:2022)
Common Criteria → SP 800-53 SP 800-53 → Common Criteria Coverage Analysis
AC (14) AU (14) CA (6) CM (5) CP (1) IA (12) MP (1) PL (4) PM (3) PS (1) PT (8) RA (1) SA (8) SC (14) SI (6)

AC Access Control

Control Name Common Criteria References
AC-01 Policy and Procedures
CC Part 2 — FMT
AC-02 Account Management
CC Part 2 — FMT
AC-03 Access Enforcement
CC Part 2 — FDP
AC-04 Information Flow Enforcement
CC Part 2 — FDP
AC-05 Separation of Duties
CC Part 2 — FDPCC Part 2 — FMT
AC-06 Least Privilege
CC Part 2 — FDPCC Part 2 — FMT
AC-07 Unsuccessful Logon Attempts
CC Part 2 — FIACC Part 2 — FRU/FTA/FTP
AC-08 System Use Notification
CC Part 2 — FRU/FTA/FTP
AC-10 Concurrent Session Control
CC Part 2 — FRU/FTA/FTP
AC-11 Device Lock
CC Part 2 — FRU/FTA/FTP
AC-12 Session Termination
CC Part 2 — FRU/FTA/FTP
AC-16 Security and Privacy Attributes
CC Part 2 — FDP
AC-17 Remote Access
CC Part 2 — FRU/FTA/FTP
AC-24 Access Control Decisions
CC Part 2 — FDP

AU Audit and Accountability

Control Name Common Criteria References
AU-01 Policy and Procedures
CC Part 2 — FAU
AU-02 Event Logging
CC Part 2 — FAU
AU-03 Content of Audit Records
CC Part 2 — FAU
AU-04 Audit Log Storage Capacity
CC Part 2 — FAU
AU-05 Response to Audit Logging Process Failures
CC Part 2 — FAU
AU-06 Audit Record Review, Analysis, and Reporting
CC Part 2 — FAU
AU-07 Audit Record Reduction and Report Generation
CC Part 2 — FAU
AU-08 Time Stamps
CC Part 2 — FAU
AU-09 Protection of Audit Information
CC Part 2 — FAU
AU-10 Non-repudiation
CC Part 2 — FAU
AU-11 Audit Record Retention
CC Part 2 — FAU
AU-12 Audit Record Generation
CC Part 2 — FAU
AU-13 Monitoring for Information Disclosure
CC Part 2 — FAU
AU-14 Session Audit
CC Part 2 — FAU

CA Security Assessment and Authorization

Control Name Common Criteria References
CA-02 Control Assessments
CC Part 3 — SARCEM
CA-03 Information Exchange
CC Part 2 — FRU/FTA/FTP
CA-04 Security Certification
CEM
CA-06 Authorization
CC Part 1 — STCCRA
CA-07 Continuous Monitoring
CEM
CA-08 Penetration Testing
CC Part 3 — SARCEM

CM Configuration Management

Control Name Common Criteria References
CM-05 Access Restrictions for Change
CC Part 2 — FMT
CM-06 Configuration Settings
CC Part 2 — FMT
CM-07 Least Functionality
CC Part 2 — FMT
CM-09 Configuration Management Plan
CC Part 2 — FMT
CM-14 Signed Components
CC Part 2 — FCSCC Part 2 — FPT

CP Contingency Planning

Control Name Common Criteria References
CP-12 Safe Mode
CC Part 2 — FPT

IA Identification and Authentication

Control Name Common Criteria References
IA-01 Policy and Procedures
CC Part 2 — FIA
IA-02 Identification and Authentication (Organizational Users)
CC Part 2 — FIA
IA-03 Device Identification and Authentication
CC Part 2 — FIA
IA-04 Identifier Management
CC Part 2 — FIA
IA-05 Authenticator Management
CC Part 2 — FIA
IA-06 Authentication Feedback
CC Part 2 — FIA
IA-07 Cryptographic Module Authentication
CC Part 2 — FCSCC Part 2 — FIA
IA-08 Identification and Authentication (Non-organizational Users)
CC Part 2 — FIA
IA-09 Service Identification and Authentication
CC Part 2 — FIA
IA-10 Adaptive Authentication
CC Part 2 — FIA
IA-11 Re-authentication
CC Part 2 — FIA
IA-12 Identity Proofing
CC Part 2 — FIA

MP Media Protection

Control Name Common Criteria References
MP-06 Media Sanitization
CC Part 2 — FDP

PL Planning

Control Name Common Criteria References
PL-02 System Security and Privacy Plans
CC Part 1 — PPCC Part 1 — ST
PL-07 Concept of Operations
CC Part 1 — PP
PL-08 Security and Privacy Architectures
CC Part 1 — PPCC Part 1 — ST
PL-09 Central Management
CC Part 2 — FMT

PM Program Management

Control Name Common Criteria References
PM-02 Information Security Program Leadership Role
CC Part 2 — FMT
PM-07 Enterprise Architecture
CC Part 1 — PP
PM-08 Critical Infrastructure Plan
CCRA

PS Personnel Security

Control Name Common Criteria References
PS-06 Access Agreements
CC Part 2 — FMT

PT Personally Identifiable Information Processing and Transparency

Control Name Common Criteria References
PT-01 Policy and Procedures
CC Part 2 — FPR
PT-02 Authority to Process Personally Identifiable Information
CC Part 2 — FPR
PT-03 Personally Identifiable Information Processing Purposes
CC Part 2 — FPR
PT-04 Consent
CC Part 2 — FPR
PT-05 Privacy Notice
CC Part 2 — FPR
PT-06 System of Records Notice
CC Part 2 — FPR
PT-07 Specific Categories of Personally Identifiable Information
CC Part 2 — FPR
PT-08 Computer Matching Requirements
CC Part 2 — FPR

RA Risk Assessment

Control Name Common Criteria References
RA-05 Vulnerability Monitoring and Scanning
CC Part 3 — SAR

SA System and Services Acquisition

Control Name Common Criteria References
SA-03 System Development Life Cycle
CC Part 3 — SAR
SA-04 Acquisition Process
CC Part 1 — PPCC Part 1 — STCC Part 3 — SARCCRA
SA-08 Security and Privacy Engineering Principles
CC Part 1 — PPCC Part 1 — STCC Part 3 — SAR
SA-09 External System Services
CCRA
SA-10 Developer Configuration Management
CC Part 3 — SAR
SA-11 Developer Testing and Evaluation
CC Part 2 — FPTCC Part 3 — SARCEM
SA-15 Development Process, Standards, and Tools
CC Part 3 — SAR
SA-17 Developer Security and Privacy Architecture and Design
CC Part 1 — STCC Part 3 — SAR

SC System and Communications Protection

Control Name Common Criteria References
SC-04 Information in Shared System Resources
CC Part 2 — FDPCC Part 2 — FPT
SC-05 Denial-of-service Protection
CC Part 2 — FRU/FTA/FTP
SC-06 Resource Availability
CC Part 2 — FRU/FTA/FTP
SC-07 Boundary Protection
CC Part 2 — FDPCC Part 2 — FPT
SC-08 Transmission Confidentiality and Integrity
CC Part 2 — FCSCC Part 2 — FDPCC Part 2 — FPT
SC-10 Network Disconnect
CC Part 2 — FRU/FTA/FTP
SC-11 Trusted Path
CC Part 2 — FRU/FTA/FTP
SC-12 Cryptographic Key Establishment and Management
CC Part 2 — FCS
SC-13 Cryptographic Protection
CC Part 2 — FCS
SC-16 Transmission of Security and Privacy Attributes
CC Part 2 — FDP
SC-17 Public Key Infrastructure Certificates
CC Part 2 — FCS
SC-23 Session Authenticity
CC Part 2 — FRU/FTA/FTP
SC-24 Fail in Known State
CC Part 2 — FPT
SC-28 Protection of Information at Rest
CC Part 2 — FCS

SI System and Information Integrity

Control Name Common Criteria References
SI-04 System Monitoring
CC Part 2 — FAU
SI-06 Security and Privacy Function Verification
CC Part 2 — FPT
SI-07 Software, Firmware, and Information Integrity
CC Part 2 — FPT
SI-12 Information Management and Retention
CC Part 2 — FDP
SI-16 Memory Protection
CC Part 2 — FPT
SI-19 De-identification
CC Part 2 — FPR